You can configure monthly and daily log ingestion limits in VMware Aria Operations for Logs (SaaS) and trigger notifications when the log ingestion volume exceeds the configured threshold values.

Prerequisites

Verify that:

  • You are logged in to the VMware Aria Operations for Logs (SaaS) web user interface as an administrator or an organization owner.
  • Or, you are assigned Write permissions for the Ingestion Limits custom role.

Procedure

  1. Navigate to Configuration > Usage Reports.
  2. Select the Ingestion Limits tab.
  3. Set the warning and critical limits for monthly and daily ingestion based on your business requirements. It is not mandatory to set all the field values.
    Option Description
    Monthly Ingestion Alert

    To configure log ingestion limits per month, perform the following steps:

    1. Switch the Monthly Ingestion Alert toggle to true.
    2. Click the calendar icon and select the day of the month from when the monthly cycle for the log usage must start.
      Note: If the start date is not selected, the first day of the month is considered as the start day.
    3. Enter the critical threshold limit for monthly ingestion.
    4. Enter the warning threshold limit for monthly ingestion.
    Daily Ingestion Alert

    To configure ingestion limits per day, perform the following steps:

    1. Switch the Daily Ingestion Alert toggle to true.
    2. Enter the critical threshold limit for daily ingestion.
    3. Enter the warning threshold limit for daily ingestion.
    4. Select the Stop ingestion if the log volume exceeds the critical threshold for the day check box if you want VMware Aria Operations for Logs (SaaS) to discard the logs when the log volume exceeds the critical threshold.
      Note:

      If you discard the logs, your ability to analyze logs to troubleshoot your environments and receive alerts will be impacted.

      Therefore, stop log ingestion only to avoid billing unplanned charges resulting from an unexpected increase in the log volume.
  4. Click Apply.

    Log usage and ingestion threshold calculations are based on the UTC timezone.

    If the log ingestion is stopped for the day, data collection resumes the next day at 12:00 AM UTC.

    Your log usage cycle resets every month on the date you have set. If your monthly log usage cycle is set to the 31st of the month and if a month does not have 31 days, then the first day of next month is considered as the start date for the monthly billing cycle. To learn more about ingestion limits, see Ingestion Limits.

Results

If the log volume exceeds the configured warning or critical threshold limit, a banner is displayed across the top of the user interface.

What to do next

  • Trigger system alerts when log ingestion exceeds the configured limits. To learn more, see Viewing System Alerts.
  • View the top log contributors by size and analyze the logs trend. To learn more, see the Log Statistics page.