Accrued usage (in bytes) and "last event seen" counters are working as of 07:25 UTC on 11 Feb 2019. Bytes received after that time and sources seen after that time will be tracked as they were before this incident.
Posted Feb 10, 2019 - 23:37 PST
Identified
We've identified the blockage and have returned logs to real-time status. Some 24-hour search alerts may not reflect accurate message counts.
Accrued usage (in bytes) and "last event seen" counters may not reflect accurate information for some customers. Engineering is actively working on restoring this functionality. This does not impact log processing/ingestion, search, or alerts.
Posted Feb 10, 2019 - 22:07 PST
Update
Engineering is still investigating. We've determined the scope to be contained to larger-volume customers. The effect is a cease of new logs in the Events viewer as well as Search Alerts not triggering. Log collection is NOT impacted so when the delay catches up, logs received during this period will become available.
Posted Feb 10, 2019 - 20:57 PST
Update
A subset of customers will see delay in events viewer. We are still investigating the cause of the log processing delay.
Posted Feb 10, 2019 - 19:48 PST
Update
We are still investigating the cause of the log processing delay and trying to process the backlog.
Posted Feb 10, 2019 - 19:01 PST
Investigating
We are currently investigating log processing delay.
Posted Feb 10, 2019 - 17:38 PST
This incident affected: Website, Log Collection, Log Search, and Search Alerts.