The vRealize Log Insight cluster consists of one master node and two worker nodes behind a load balancer.

You enable the integrated load balancer (ILB) on the cluster so that all log sources can address the cluster by its ILB. By using the ILB, you need not reconfigure all log sources with a new destination address in a future scale-out. Using the ILB also guarantees that vRealize Log Insight accepts all incoming ingestion traffic.

vRealize Log Insight users, using both the Web user interface or API, and clients, ingesting logs by using syslog or the Ingestion API, connect to vRealize Log Insight using the ILB address.

A vRealize Log Insight cluster can scale out to 12 nodes, that is, 1 master and 11 worker nodes.

Table 1. Design Decisions on the Node Configuration of vRealize Log Insight

Decision ID

Design Decision

Design Justification

Design Implication

ROBO-OPS-LOG-001

In each ROBO, deploy vRealize Log Insight in a cluster configuration of 3 nodes with an integrated load balancer: one master and two worker nodes.

  • Provides high availability.

  • Using the integrated load balancer prevents a single point of failure.

  • Using the integrated load balancer simplifies the vRealize Log Insight deployment and subsequent integration.

  • Using the integrated load balancer simplifies the vRealize Log Insight scale-out operations reducing the need to reconfigure existing logging sources.

  • You must deploy a minimum of 3 medium nodes.

  • You must size each node identically.

  • If the capacity requirements for your vRealize Log Insight cluster expand, identical capacity must be added to each node.

ROBO-OPS-LOG-002

Apply vSphere Distributed Resource Scheduler (DRS) anti-affinity rules to the vRealize Log Insight cluster components.

Prevents the vRealize Log Insight nodes from running on the same ESXi host and risking the high availability of the cluster.

  • You must perform additional configuration to set up anti-affinity rules.

  • You can put in maintenance mode only a single ESXi host at a time in the management cluster of four ESXi hosts.