You can forward VMware Live Cyber Recovery events to VMware Aria Operations for Logs.

You can also forward VMware Live Cyber Recovery events to other VMware Cloud Services organizations (in the same region) that have VMware Aria Operations for Logs enabled. You can forward events to any organization you have access to, but you can only forward events to one organization at a time.

For information about data ingestions limits, see Getting Started with VMware Aria Operations for Logs.
Note: You must add the VMware Aria Operations for Logs service to your organization before you can enable event forwarding.

Prerequisites

You can forward all events, including those related to protected sites, snapshot replication, cloud file systems, recovery plans, recovery SDDCs, and user interactions in the following ways:
  • From a time in the past to the present and going forward.
  • From the present going forward.

You set up event forwarding to VMware Aria Operations for Logs by creating an API key and generating a URL associated with that API key. You can then use the API key and URL to forward events to VMware Aria Operations for Logs.

Procedure

  1. From the left navigation, click Settings > Log Insight Cloud.
  2. In the VMware Aria Operations for Logs integration dialog box, click Open Log Insight. VMware Aria Operations for Logs launches.
  3. In the VMware Aria Operations for Logs UI, from the left navigation click Configuration > API Keys.
  4. Click New API Key (upper-right).
  5. In the New API Key window, enter a name for the key. This name cannot contain spaces and must be unique.
  6. Click the Create button.
  7. In the generated API Key window, click the Copy URL and paste the text, and then click Copy Key and paste the text. Keep both values so you can enter them in the VMware Live Cyber Recovery UI.
  8. Switch back to the VMware Live Cyber Recovery UI and to the VMware Aria Operations for Logs integration dialog box. If the dialog box has closed, navigate to Settings > Log Insight Cloud.
  9. In the VMware Aria Operations for Logs integration dialog box, enter both the URL and Key.
  10. Click Validate.
  11. In the Event forwarding section, select an event forwarding option:
    • Forward events starting now.
    • Forward events starting from a past date.
    Note: Selecting to "Forward events starting from a past date" might result in duplicate events in VMware Aria Operations for Logs. For example, if you configure event forwarding to VMware Aria Operations for Logs, stop event forwarding, and then later restart event forwarding using the "Forward events starting from a past date," you might see duplicate events in VMware Aria Operations for Logs.
  12. If you choose 'From a past date,' click one of the pre-set time buttons. Or you can use the calendar picker to select a date in the past that you want to start forwarding events from.
  13. If forwarding from a past date, you can optionally use the Calendar picker to select a stop date and time for event forwarding.
    If there are no past events, then only events starting from the present time are forwarded. The first time you connect, it can take up to a minute or more to begin forwarding events.
  14. Click OK. You see a green checkmark icon if the operation was successful.

What to do next

Once you have configured event forwarding, you can see VMware Live Cyber Recovery events as they appear in VMware Aria Operations for Logs. For example, this image shows an information event from VMware Live Cyber Recovery indicating that the number of VMs in a protection group has increased: VMware Live Cyber Recovery events as seen in VMware Aria Operations for Logs.