Configure archive and retention parameters of VMware Aria Operations for Logs according to the company policy for compliance and governance.

Each VMware Aria Operations for Logs appliance has three default virtual disks and can use more virtual disks for storage.
Table 1. Virtual Disk Configuration on the VMware Aria Operations for Logs Appliance

Hard disk

Size

Usage

Hard disk 1

20 GB

Root file system

Hard disk 2

510 GB for a medium-size deployment

Contains two partitions:

  • /storage/var for system logs

  • /storage/core for collected logs
You configure a retention period for the collected logs.
Table 2. Design Decision on Log Retention for VMware Aria Operations for Logs

Decision ID

Design Decision

Design Justification

Design Implication

ILA-VAOL-CFG-010

Configure a retention period for the medium-size VMware Aria Operations for Logs appliance according to the design objectives.

Accommodates logs from the expected number of logging sources in this SDDC design.

None.
If you must retain logs for an extended period for compliance, auditability, or a customer-specific reason, you configure VMware Aria Operations for Logs to archive log data.
Table 3. Log Archiving Attributes

Attribute

Description

Archiving period

VMware Aria Operations for Logs archives log messages as soon as possible. At the same time, the logs are retained on the virtual appliance until the free local space is almost filled. Data exists on both the VMware Aria Operations for Logs appliance and the archive location for most of the retention period. The archiving period must be longer than the retention period.

Archive location

The archive location must be on an NFS version 3 (NFSv3) shared storage. The archive location must be available and must have enough capacity to accommodate the archives.
You can calculate the required archiving storage by using the Sizing Estimator for VMware Aria Operations for Logs.
Table 4. Design Decision on Log Archive Policy for VMware Aria Operations for Logs

Decision ID

Design Decision

Design Justification

Design Implication

ILA-VAOL-CFG-011

Apply an archive policy for the medium-size VMware Aria Operations for Logs appliance according to the design objectives.

Accommodates historical logs according to the design objectives.

You must provide enough shared storage space in each VMware Cloud Foundation instance for log archival according to the design objectives.

ILA-VAOL-CFG-012

Provide an NFS version 3 shared storage to the VMware Aria Operations for Logs cluster in each VMware Cloud Foundation instance according to the design objectives.

Accommodates log archiving according to the design objectives.

  • You must maintain the VMware Aria Operations for Logs archive data blobs stored on the NFS shared storage, selectively cleaning the datastore when more space is required.

  • If you configure more logging sources to send logs to VMware Aria Operations for Logs or if you add VMware Aria Operations for Logs worker nodes , you must increase the size of the NFS shared storage.

  • You must enforce the archive policy directly on the shared storage.

  • If the NFS mount does not have enough free space or is unavailable for a period greater than the retention period of the appliance, VMware Aria Operations for Logs stops ingesting new data until the NFS mount has enough free space, becomes available, or archiving is deactivated.

  • When using two availability zones, ensure that the NFS share is available in both availability zones.