You can forward logs collected by an agent to up to three destinations. A destination can include VMware Aria Operations for Logs servers or forwarder, or third-party log management solutions.

For example, you might want to send audit or system logs to a server for your security team, application logs to a dev ops team server, and metrics logs to an IT management system. You use filters to specify which information goes to a destination. You can forward logs from a single VMware Aria Operations for Logs agent to up to three destinations.

Agent configuration is done through the [server|<dest_id>] section of your local liagent.ini file. Use the cfapi protocol with VMware Aria Operations for Logs servers or forwarders and syslog with other targets or destinations.

When you specify more than one destination for an agent, the first destination uses the default loginsight location. You must specify location information for other destinations.

The next example shows a portion of an liagent.ini file that specifies two destinations. The default server name loginsight is implicit for the first destination by default and is not specified. The second [server|<dest_id>] section specifies a destination. 

; The first (default) destination receives all collected events.
[server]
ssl=yes

; The second destination receives just syslog events through the plain syslog protocol.
[server|syslog-audit]
hostname=third_party_audit_management.eng.vmware.com
proto=syslog
ssl=no

For information about creating filters for agents, see Filtering Log Events from VMware Aria Operations for Logs Agents.