When a log source is deleted, are all events associated with this source also deleted from the system or are they stored on the hard disk?

If they are saved, how is it possible to delete them so that they do not take up space?

They are not deleted from the hard disk. The only mechanism i am aware of is the retention setting that cause events to be deleted. It can also defined by logsource but in advance only. When changing it it will only influence the ones arriving after the change not before the change.

Thanks Martin.

I'm going to create a support case for aclarate this behavior and try to locate the correct procedure for eliminame the data of log sources that not sending more events to qradar, and recovery the space in the hardisk.

I try to update this post when support reply to me, for future questions from the community.