Default Configuration of the VMware Aria Operations for Logs Windows Agent

After installation, the liagent.ini file contains pre-configured default settings for the VMware Aria Operations for Logs Windows Agent.

VMware Aria Operations for Logs Windows Agent liagent.ini Default Configuration

If you use non-ASCII names and values, save the configuration as UTF-8.

If you are using central configuration, the final configuration is this file joined with settings from the server to form the liagent-effective.ini file.

You may find it more efficient to configure the settings from the server's agents page.

; Client-side configuration of VMware Log Insight Agent.
; See liagent-effective.ini for the actual configuration used by VMware Log Insight Agent.

[server]
; Log Insight server hostname or ip address
; If omitted the default value is LOGINSIGHT
;hostname=LOGINSIGHT

;Enables or deactivates centralized configuration from the vRealize Log Insight server. 
;When enabled, agent configuration changes made to the liagent.ini file on the server
;are joined with the settings in this file. to this agent. Accepted values are yes or no and  0 or 1. 
;The default is yes.
;
;central_config=yes
;

; Set protocol to use:
; cfapi - Log Insight REST API
; syslog - Syslog protocol
; If omitted the default value is cfapi
;
;proto=cfapi

; Log Insight server port to connect to. If omitted the default value is:
; for syslog: 514
; for cfapi without ssl: 9000
; for cfapi with ssl: 9543
;port=9000

;ssl - enable/deactivate SSL. Applies to cfapi protocol only.
; Possible values are yes or no. If omitted the default value is no.
;ssl=no

; Time in minutes to force reconnection to the server
; If omitted the default value is 30
;reconnect=30

; FIPS mode.
; Possible values are 1 or 0. If omitted the default value is 1.
; ssl_fips_mode=1

[storage]
;max_disk_buffer - max disk usage limit (data + logs) in MB:
; 100 - 2000 MB, default 200
;max_disk_buffer=2000

[logging]
;debug_level - the level of debug messages to enable:
;   0 - no debug messages
;   1 - trace essential debug messages
;   2 - verbose debug messages (will have negative impact on performance)
;debug_level=0
;
;The interval in minutes to print statistics
;stats_period=15

[update]
; Do not change this parameter
package_type=msi

; Enable automatic update of the agent. If enabled:
; the agent will silently check for updates from the server and
; if available will automatically download and apply the update.
;auto_update=yes

[winlog|Application]
channel=Application
raw_syslog=no

[winlog|Security]
channel=Security

[winlog|System]
channel=System

Parameter	Default Value	Description
hostname	`LOGINSIGHT`	IP address or host name of the VMware Aria Operations for Logs virtual appliance. The default is `loginsight`.
central_config	`yes`	Activate or deactivate centralized configuration for this agent. When centralized configuration is deactivated, the agent ignores configuration provided by the VMware Aria Operations for Logs server. Accepted values are `yes`, `no`,`1`, or `0`. The default value is `yes`.
proto	`cfapi`	Protocol that the agent uses to send log events to the VMware Aria Operations for Logs server. The possible values are `cfapi` and `syslog`. The default is cfapi.
port	9543, 9000, 6514, and 514	Communication port that the agent uses to send log events to the VMware Aria Operations for Logs or third party server. By default the agent uses the appropriate port based on the options that are set for SSL and the protocol. See default port values provided in the list below. You need to specify the port option only if it's different from these defaults. cfapi with SSL activated: 9543 cfapi with SSL deactivated: 9000 syslog with SSL activated: 6514 syslog with SSL deactivated: 514
ssl	`yes`	Enables or deactivates SSL. The default value is yes. When `ssl` is set to yes, if you do not set a value for the port, the port is automatically picked up as 9543.
max_disk_buffer	200	The maximum disk space in MB that the VMware Aria Operations for Logs Windows Agent uses to buffer events and its own logs. When the specified max_disk_buffer is reached, the agent begins to drop new incoming events.
debug_level	0	Defines the log details level. See Define Log Details Level in the VMware Aria Operations for Logs Agents.
channel	Application, Security, System	The Application, Security, and System Windows Event Log channels are commented by default; the VMware Aria Operations for Logs Windows Agent does not collect logs from these channels. See Collect Logs from Windows Events Channels.
raw_syslog	`no`	For agents that use the syslog protocol, allows the agent to collect and send raw syslog events. The default is no, which means collected events are transformed with user-specified syslog attributes. Activate this option to collect log events without any syslog transformations. Accepted values are yes or 1 and no or 0.
ssl_fips_mode	1	Enables or deactivates FIPS mode for the VMware Aria Operations for Logs Windows Agent through the liagent.ini file. Accepted values are 1 and 0.