I was wondering what happens when a log source is deleted. As far as I understand SWR, al imported logs are linked to a log source. This information is used when generating reports. But, what happens when I for whatever reason delete a log source? Do the logs disappear? Are they linked to another log source?
You are correct, the imported log data is associated with the original log source. This servers two primary functions.
1) Used by our log parsing caching scheme for performance. So only important detail here is to keep one log source per web proxy (device or software).
2) For purposes of reporting (report filters). So if you have two phisical locations (for example North America and Asia) with one proxy in each location, this allows you to create a report filter to generate reports on each geographical location.
So to answer your question, if you delete a log source, none of the imported data is deleted or modified. You can still do everything that you could before, except import more data into that log source. For example, you can still create report filters for the log source, you can still performan manual database maintenance for that log source, etc. The names of your deleted log sources will remain in the GUI drop-down boxes indefinately. Currently there is no supported method for removing those.