I need to move some assets in the Physical Display from one grouping to a new one. This is being done as part of a cleanup effort and to get both application and OS logs. To apply two Data Source Models to the same asset, (e.g. OS and IIS) I need to apply two Data Source profiles. This will involve moving the asset from "Receiver->asset" to "Receiver->Data Source group->asset".
I'm concerned that this will cause the loss of whatever logs have been gathered to date.
did i understand you right? You want to move Datasource from one Receiver to another? If yes and you want to move all than you can use the migrate option of each Receiver.
The intent is not to move between two Receivers (although we do have two) but to better organize the schema for better, more comprehensive log collection.
If this is the best way to move them without losing logs then I could shuffle the assets between Receivers...
Got it, but same rules still apply. No nice way to move data between Parent/Children unfortunately. Set devices to disabled, enable the Hide Disabled option under the user Options and future logs will be better organized while older logs will still be searchable.
The key to never losing ESM data is to never delete a data source. You can uncheck the Parsing/Logging boxes and disable it, but if you delete it, then the data goes along with it. As xded mentioned, there is a "Migrate" button under Receiver Properties | Data Sources, but if that isn't an option, then the practice is always disable and recreate elsewhere. Never delete a data source until you're done with the data.
True statement. If that's an issue though, you're likely already using client data sources then and the same rules apply and you get a 62k+ more data sources.