Unwanted pruning of Elastic Agent events

[imaohw1337]

Version

2.4.90

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

24

RAM

64gb

Storage for /

447gb

Storage for /nsm

6705gb

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

We've had elastic agent deployed and working for months. We've been updated to version 2.4.90 for a couple weeks now and out of the blue we've noticed Windows Events coming from the elastic agent are being pruned and in certain "event.dataset"'s like "windows.forwarded" we're only able to search less than 24 hours of data. The rest of our logs like Syslog and Zeek are being kept/searchable for 30 days.

NSM partition is only at 54% usage. Haven't messed with the default index settings at all. We'd like to at least have 30 days of events searchable for Elastic Agent logs and this has this has never been an issue previously.

Hoping that there's a setting I can be pointed to fix/future-proof so this issue can be resolved.

Thanks.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

@imaohw1337 This is resolved?