Data archiving preserves old logs that might otherwise be removed from an index partition after the retention period. See Data Archiving. You can use the command line to import logs that have been archived in VMware Aria Operations for Logs.

Note: Although VMware Aria Operations for Logs can handle historic data and real-time data simultaneously, you are advised to deploy a separate instance of VMware Aria Operations for Logs to process imported log files.

Prerequisites

  • Verify that you have the root user credentials to log in to the VMware Aria Operations for Logs virtual appliance.
  • Verify that you have access to the NFS server where VMware Aria Operations for Logs logs are archived.
  • Verify that the VMware Aria Operations for Logs virtual appliance has enough disk space to accommodate the imported log files.

    The minimum free space in the /storage/core partition on the virtual appliance must equal approximately 10 times the size of the archived log that you want to import.

Procedure

  1. Establish an SSH connection to the VMware Aria Operations for Logs vApp and log in as the root user.
  2. Mount the shared folder on the NFS server where the archived data resides.
  3. To import a directory of archived VMware Aria Operations for Logs logs, run the following command. 
    /usr/lib/loginsight/application/bin/loginsight repository import Path-To-Archived-Log-Data-Folder.
    Note:
    • To avoid the modification of the timestamp of the directory to be imported, ensure that this command is executed from a directory other than the one you want to import. Running the command from the directory you want to import results in the creation of a JavaClient.log file and an update of the directory's modification timestamp.
    • Importing archived data might take a long time, depending on the size of the imported folder.
  4. Close the SSH connection.

What to do next

You can search, filter, and analyze the imported log events.