You can use static IP addresses and FQDN to avoid risk during backup, restoration, and disaster recovery operations.

Static IP Addresses for VMware Aria Operations for Logs Cluster Nodes and Load Balancer

When you use static IP addresses for all nodes in a VMware Aria Operations for Logs cluster, you eliminate the need to update the IP addresses of the cluster nodes when the IP addresses change.

VMware Aria Operations for Logs includes all node IP addresses in each cluster node configuration file as described in Knowledge Base article 2123058

All products that integrate with VMware Aria Operations for Logs (ESXi, vSphere, VMware Aria Operations) use the cluster primary node's fully qualified domain name (FQDN) or IP address as the syslog target. Those products might use the FQDN or IP address of the load balancer, if configured, as the syslog target. Static IP addresses reduce the risk of constantly updating the syslog target IP address in multiple locations.

Provide static IP addresses and optional virtual IP addresses for the load balancer. When configuring an integrated load balancer, provide the optional FQDN for the virtual IP address. The FQDN is used when an IP address is not reachable for any reason.

FQDN for VMware Aria Operations for Logs Cluster Nodes and Worker Node

When you use an FQDN for all nodes in the VMware Aria Operations for Logs cluster, you can save time on post-restoration and recovery configuration changes, assuming that the same FQDN can be resolved on the recovery site.

For the primary node (load balancer when used), a fully resolvable FQDN is required. Otherwise, the ESXi hosts fail to feed the syslog messages to VMware Aria Operations for Logs or to any remote target. 

For system notifications, VMware Aria Operations for Logs uses FQDN host names, if available, instead of IP addresses.  

You can reasonably assume that only the underlying IP addresses change after backup and restoration or disaster recovery operations. Using FQDN eliminates the need to change the syslog target address (primary node FQDN or internal load balancer FQDN) on all the external devices that feed logs to the VMware Aria Operations for Logs cluster.

Verify that join requests from a VMware Aria Operations for Logs worker node use the FQDN of the VMware Aria Operations for Logs primary node.

The primary node host value in the configuration file on each of the nodes is based on the value used by the first worker node sending a join request. Using the FQDN of the primary node for the join request prevents making any manual changes to the primary node host value post-disaster recovery. Otherwise, the worker nodes cannot rejoin the primary node until the primary node host name is updated in the configuration files on all restored cluster nodes.