Hi Team,
By product design when we configure external logging the logs from SEPM gets forwarded to the Syslog server. In case we turn the log forwarding off and then turn on SEPM send all the logs that were to be send from the time the loggin was turned Off. SEPM keeps sort of a Bookmark of the logs sent and sends from that point and not real time.
We have more that 100 Thousand machines and if for some reason we Turn off the loggin and then tunr it back on, the old logs (which in fact will be huge in number) is irelavant for us. I do understand there might be organaisation that have policy to keep all the logs, but for some it is not needed and it creats unwanted trouble.
It woudl really help if we could have an option to clear the bookmark part so that only the current logs come in