Access logs must be saved which can be copied to graylog.

Other then that the vm can be removed and it’s ip.
from the dns.

Need to wait a few days before processing this (so 12 days passed).