vRealize Log Insight collects log events from all management components in each region of the SDDC.

Logical Design

In a multi-region Software-Defined Data Center, deploy a vRealize Log Insight cluster that consists of three nodes in each region. This configuration provides continued availability and increased log ingestion rates.

Figure 1. Logical Design of vRealize Log Insight


In this validated design, vRealize Log Insight retrieves log information from all management components in the dual-region SDDC. The Log Insight deployment consists of three nodes to accommodate the scale of the deployment.

Sources of Log Data

vRealize Log Insight collects logs as to provide monitoring information about the SDDC from a central location.

vRealize Log Insight collects log events from the following virtual infrastructure and cloud management components.

  • Management cluster

    • Platform Services Controller

    • vCenter Server

    • Site Recovery Manager

    • ESXi hosts

  • Shared edge and compute cluster

    • Platform Services Controller

    • vCenter Server

    • ESXi hosts

  • NSX for vSphere for the management cluster and for the shared compute and edge cluster

    • NSX Manager instances

    • NSX Controller instances

    • NSX Edge services gateway instances NSX distributed logical router instances

    • NSX universal distributed logical router instances

    • NSX distributed firewall ESXi kernel module

  • vRealize Lifecycle Manager

  • vRealize Automation

    • vRealize Automation Appliance

    • vRealize Orchestrator (embedded in the vRealize Automation Appliance)

    • vRealize IaaS Web Server

    • vRealize IaaS Management Server

    • vRealize IaaS DEM

    • vRealize IaaS Proxy Agents

    • Microsoft SQL Server

  • vRealize Business

    • vRealize Business server

    • vRealize Business data collector

  • vRealize Operations Manager

    • Analytics cluster nodes

    • Remote collectors

  • vRealize Log Insight instance in the other region as a result of event forwarding