The vRealize Log Insight cluster consists of one master node and two worker nodes behind a load balancer.

You enable the integrated load balancer (ILB) on the 3-node cluster so that all log sources can address the cluster by its ILB. By using the ILB, you need not reconfigure all log sources with a new destination address in a future scale-out. Using the ILB also guarantees that vRealize Log Insight accepts all incoming ingestion traffic.

vRealize Log Insight users connect to vRealize Log Insight using the ILB address. They use the ILB address when using the Web user interface or API, and clients, and when ingesting logs via syslog or the Ingestion API.

vRealize Log Insight cluster can scale out to 12 nodes, that is, 1 master and 11 worker nodes.

Table 1. Design Decisions about Node Configuration for vRealize Log Insight

Decision ID

Design Decision

Design Justification

Design Implication

SDDC-OPS-LOG-001

Deploy vRealize Log Insight in a cluster configuration of 3 nodes with an integrated load balancer: one master and two worker nodes.

Using the integrated load balancer (ILB) has the following advantages:

  • Provides high availability.

  • Prevents a single point of failure.

  • Simplifies the Log Insight deployment and subsequent integration.

  • Simplifies the Log Insight scale-out operations reducing the need to reconfigure existing logging sources

  • You must deploy a minimum of 3 medium nodes.

  • You must size each node identically.

  • If the capacity requirements for your vRealize Log Insight cluster grow, identical capacity must be added to each node.

SDDC-OPS-LOG-002

Apply vSphere Distributed Resource Scheduler (DRS) anti-affinity rules to the vRealize Log Insight cluster components.

Using DRS prevents the vRealize Log Insight nodes from running on the same ESXi host and risking the high availability of the cluster.

  • You must perform additional configuration to set up anti-affinity rules.

  • You can put in maintenance mode only a single ESXi host at a time in the management cluster of four ESXi hosts.