Configure archive and retention parameters of vRealize Log Insight according to the company policy for compliance and governance.

vRealize Log Insight virtual appliances contain three default virtual disks and can use addition virtual disks for storage.

Table 1. Virtual Disk Configuration in the vRealize Log Insight Virtual Appliance

Hard Disk

Size

Usage

Hard disk 1

20 GB

Root file system

Hard disk 2

510 GB for medium-size deployment

Contains two partitions:

  • /storage/var System logs

  • /storage/core Storage for Collected logs.

Hard disk 3

512 MB

First boot only

Calculate the storage space that is available for log data using the following equation:

/storage/core = hard disk 2 space - system logs space on hard disk 2

Based on the size of the default disk, the storage core is equal to 490 GB.

/storage/core = 510GB - 20 GB = 490 GB
Retention = /storage/core – 3% * /storage/core

If /storage/core is 490 GB, vRealize Log Insight can use 475 GB for retention.

Retention = 490 GB - 3% * 490 ≈ 475 GB 

Configure a retention period of 7 days for the medium-size vRealize Log Insight appliance.

Table 2. Retention Period Design Decision

Decision ID

Design Decision

Design Justification

Design Implication

SDDC-OPS-LOG-007

Configure vRealize Log Insight to retain data for 7 days.

Accommodates logs from 750 syslog sources (250 per node) as per the SDDC design.

None

If you must support a log retention period that is greater than the prescribed 7 days, additional storage may be added to each virtual appliance. When adding storage to increase the retention, the capacity supplied must be identical across all virtual appliances.

Archiving

You configure vRealize Log Insight to archive log data only if your must retain logs for an extended period of time, either for compliance, auditability, and so on.

vRealize Log Insight archives log messages as soon as possible. At the same time, the logs are retained on the virtual appliance until the free local space is almost filled. Data exists on both the vRealize Log Insight appliance and the archive location for most of the retention period. The archiving period must be longer than the retention period.

The archive location must be on an NFS version 3 shared storage. The archive location must be available and must have enough capacity to accommodate the archives.

Apply an archive policy of 90 days for the medium-size vRealize Log Insight appliance. The vRealize Log Insight appliance will use about 1 TB of shared storage. According to the business compliance regulations of your organization, these sizes might change.

Table 3. Log Archive Policy Design Decision

Decision ID

Design Decision

Design Justification

Design Implication

SDDC-OPS-LOG-008

Provide 1 TB of NFS version 3 shared storage to each vRealize Log Insight cluster.

Archives logs from 750 syslog sources.

  • You must manually maintain the vRealize Log Insight archive blobs stored on the NFS store, selectively pruning as more space is required.

  • You must enforce the archive policy directly on the shared storage.

  • If the NFS mount does not have enough free space or is unavailable for a period greater than the retention period of the virtual appliance, vRealize Log Insight stops ingesting new data until the NFS mount has enough free space, becomes available, or archiving is disabled.