vRealize Log Insight collects log events from all management components in each region of the SDDC.
Logical Design
In a ROBO SDDC, deploy a vRealize Log Insight configuration that consists of the following entities.
3-node (medium-size) vRealize Log Insight cluster per region in the hub with log forwarding configured between the regions. This topology provides high availability, scale-out capacity up to sixteen nodes, and mirrored data sets per region.
3-node (small-size) vRealize Log Insight cluster in each ROBO site. This configuration supports localized high availability and increased log ingestion rates in each ROBO site. The ROBO site forwards log data to each region. In this way, you implement a single pane of glass to all logging data from the ROBO site in each region of the hub.


Sources of Log Data
vRealize Log Insight collects logs as to provide monitoring information about the SDDC from a central location.
vRealize Log Insight collects log events from the following virtual infrastructure and cloud management components.
Consolidated cluster
vCenter Server with an embedded Platform Services Controller
ESXi hosts
NSX for vSphere for the consolidated cluster
NSX Manager
NSX Controller instances
NSX Edge services gateway instances
NSX distributed logical router
NSX distributed firewall ESXi kernel module
vRealize Automation
vRealize IaaS Proxy Agents
vRealize Business
vRealize Business data collector
vRealize Operations Manager
Remote collectors