Community Forum

Event log deletions by Comcast?

Regular Contributor

Event log deletions by Comcast?

I am trying to monitor the event log on my SB8200 and generate alerts based on problems recorded in the event log.   This morning there was a reboot of my modem due to what appears to be T3 timeouts.    On inspecting the event log I noticed events from 2/10/2020 are no longer in the event log but events from 1/24/2020 and 1/25/2020 are as well as events from this morning (2/14/2020).    I called Arris thinking this was a bug in their firmware and asked if it was a known issue.   I explained that it's not as if events dropped off the end, it's events in the middle of the log that are missing.    The support person said that there are no known bugs that would cause events to go missing in the log and he indicated that only the ISP can delete entries from the event log.


Assuming that he is correct what would be the reason for deleting event log entries?    The two in question simply indicate a download started/wrong SW file so I'm not sure why they would be deleted:


| 40 | 202004317 | 02/10/2020 18:48 | 69010200 | 6 | SW Download INIT - Via Config file |
| 41 | 202004317 | 02/10/2020 18:48 | 69010700 | 4 | SW upgrade Failed after download - Incompatible SW file


On closer inspection I see additional lines missing (ah the benefits of writing all of this to a database).   Would anyone from Comcast like to comment on whether or not it is true that Comcast can and does delete entries from event logs and if so, why are you deleting them?   Doing so makes it *exceptionally* difficult to find data overlaps and it makes it nearly impossible to obtain an accurate picture of the health of my modem.