Accrued usage (in bytes) and "last event seen" counters are working as of 07:25 UTC on 11 Feb 2019. Bytes received after that time and sources seen after that time will be tracked as they were before this incident.
Feb 10, 23:37 PST
We've identified the blockage and have returned logs to real-time status. Some 24-hour search alerts may not reflect accurate message counts.
Accrued usage (in bytes) and "last event seen" counters may not reflect accurate information for some customers. Engineering is actively working on restoring this functionality. This does not impact log processing/ingestion, search, or alerts.
Feb 10, 22:07 PST
Engineering is still investigating. We've determined the scope to be contained to larger-volume customers. The effect is a cease of new logs in the Events viewer as well as Search Alerts not triggering. Log collection is NOT impacted so when the delay catches up, logs received during this period will become available.
Feb 10, 20:57 PST
A subset of customers will see delay in events viewer. We are still investigating the cause of the log processing delay.
Feb 10, 19:48 PST
We are still investigating the cause of the log processing delay and trying to process the backlog.
Feb 10, 19:01 PST
We are currently investigating log processing delay.
Feb 10, 17:38 PST