Configure archive and retention parameters of vRealize Log Insight according to the company policy for compliance and governance.

Each vRealize Log Insight virtual appliance has three default virtual disks and can use more virtual disks for storage.

Table 1. Virtual Disk Configuration in the vRealize Log Insight Virtual Appliance

Hard Disk

Size

Usage

Hard disk 1

20 GB

Root file system

Hard disk 2

510 GB for medium-size deployment

Contains two partitions:

  • /storage/var. System logs

  • /storage/core. Storage for collected logs

Hard disk 3

512 MB

First boot only

Calculate the storage space that is available for log data using the following equation:

/storage/core = hard disk 2 space - system logs space on hard disk 2

Based on the size of the default disk, the storage core is equal to 490 GB. If /storage/core is 490 GB, vRealize Log Insight can use 475 GB for retaining accessible logging data.

/storage/core = 510 GB - 20 GB = 490 GB
Retention = /storage/core – 3% * /storage/core
Retention = 490 GB - 3% * 490 ≈ 475 GB disk space per vRLI appliance

You can calculate retention time by using the following equations:

GB per vRLI Appliance per day = (Amount in GB of disk space used per day  / Number of vRLI appliances) * 1.7 indexing
Retention in days = 475 GB disk space per vRLI appliance / GB per vRLI Appliance per day
(15 GB of logging data ingested per day / 3 vRLI appliances) * 1.7 indexing ≈ 8.5 GB per vRLI Appliance per day
475 GB disk space per vRLI appliance / 8.5 GB per vRLI Appliance per Day ≈ 55 days of retention

Configure a retention period of 7 days for the small-size vRealize Log Insight appliance.

Table 2. Design Decision on Retention Period in vRealize Log Insight

Decision ID

Design Decision

Design Justification

Design Implication

ROBO-OPS-LOG-006

Configure vRealize Log Insight to retain data for 7 days.

Accommodates logs from 77 syslog sources and vRealize Log Insight Agents as per the SDDC design.

None.

Archiving

You configure vRealize Log Insight to archive log data only if you must retain logs for an extended period for compliance, auditability, or a customer-specific reason.

Attribute of Log Archiving

Description

Archiving period

vRealize Log Insight archives log messages as soon as possible. At the same time, the logs are retained on the virtual appliance until the free local space is almost filled. Data exists on both the vRealize Log Insight appliance and the archive location for most of the retention period. The archiving period must be longer than the retention period.

Archive location

The archive location must be on an NFS version 3 shared storage. The archive location must be available and must have enough capacity to accommodate the archives.

In the ROBO SDDC, to reduce the overall footprint in ROBO and remove the requirement for an NFS share in the ROBO site, perform log archiving only in the hub.