Great ,
> According to evaluation guide, only one source is sending logs. if we have multiple source at each location then should we create seperate-2 connectors and set the log location accordingly right?
> what about the syslogs/normalized logs that are stored on local syslog servers...after sending all to LEM, logs will be purged or need to delete(as per weekly or daily process) . actually concern is disk usgae becasue each location has approx 30-40 GB/day raw logs.