vRealize Log Insight provides real-time log management and log analysis with machine learning-based intelligent grouping, high-performance searching, and troubleshooting across physical, virtual, and cloud environments.


vRealize Log Insight collects data from ESXi hosts using the syslog protocol. vRealize Log Insight has the following capabilities:

  • Connects to other VMware products, like vCenter Server, to collect events, tasks, and alarm data.
  • Integrates with vRealize Operations Manager to send notification events and enable launch in context.
  • Functions as a collection and analysis point for any system that is capable of sending syslog data.

To collect additional logs, you can install an ingestion agent on Linux or Windows servers, or you can use the pre-installed agent on certain VMware products. Using pre-installed agents is useful for custom application logs and operating systems that do not natively support the syslog protocol, such as Windows.


vRealize Log Insight is available as a pre-configured virtual appliance in OVF. By using the virtual appliance, you can easily create vRealize Log Insight nodes with pre-defined identical sizes.

You deploy the OVF file of the virtual appliance once for each node. After node deployment, you access the product to set up cluster nodes according to their role and log in to configure the installation.

Deployment Models

You can deploy vRealize Log Insight as a virtual appliance in one of the following configurations:

  • Standalone node
  • Cluster of one primary and at least two worker nodes. You can establish high availability by using the integrated load balancer (ILB).

The compute and storage resources of the vRealize Log Insight instances can scale-up as growth demands.


The architecture of vRealize Log Insight in the SDDC enables several channels for the collection of log messages.

Figure 1. Architecture of vRealize Log Insight

Each node in the vRealize Log Insight cluster contains repository, database, load balancing electing, syslog ingestion and UI modules.

vRealize Log Insight clients connect to the ILB Virtual IP (VIP) address, and use the syslog or the Ingestion API via the vRealize Log Insight agent to send logs to vRealize Log Insight. Users and administrators interact with the ingested logs using the user interface or the API.

By default, vRealize Log Insight collects data from vCenter Server systems and ESXi hosts. For forwarding logs from NSX for vSphere and vRealize Automation, use content packs. They contain extensions or provide integration with other systems in the SDDC.

Types of Nodes

For functionality, high availability and scalability, vRealize Log Insight supports the following types of nodes which have inherent roles:

Primary Node
Required initial node in the cluster. In standalone mode, the primary node is responsible for all activities, including queries and log ingestion. The primary node also handles operations that are related to the lifecycle of a cluster, such as performing upgrades and addition or removal of worker nodes. In a scaled-out and highly available environment, the primary node still performs lifecycle operations such as addition or removal of worker nodes. However, it functions as a generic worker about queries and log ingestion activities.

The primary node stores logs locally. If the primary node is down, the logs stored on it become unavailable.

Worker Node
Optional. This component enables scale-out in larger environments. As you add and configure more worker nodes in a vRealize Log Insight cluster for high availability (HA), queries and log ingestion activities are delegated to all available nodes. You must have at least two worker nodes to form a cluster with the primary node.

The worker node stores logs locally. If any of the worker nodes is down, the logs on the worker become unavailable.

The VMware Validated Design for Workload and Management Consolidation does not use worker nodes. For high availability and a scaled-out vRealize Log Insight cluster, refer to the VMware Validated Design for Software-Defined Data Center.

Integrated Load Balancer (ILB)
In cluster mode, the ILB is the centralized entry point which ensures that vRealize Log Insight accepts incoming ingestion traffic. As nodes are added to the vRealize Log Insight instance to form a cluster, the ILB feature simplifies the configuration for high availability. The ILB balances the incoming traffic fairly among the available vRealize Log Insight nodes.

The ILB runs on one of the cluster nodes at all times. In environments that contain several nodes, an election process determines the leader of the cluster. Periodically, the ILB performs a health check to determine whether re-election is required. If the node that hosts the ILB Virtual IP (VIP) address stops responding, the VIP address is failed over to another node in the cluster via an election process.

All queries against data are directed to the ILB. The ILB delegates queries to a query primary for the duration of the query. The query primary queries all nodes, both primary and worker nodes, for data and then sends the aggregated data back to the client.

Use the ILB for administrative activities unless you are performing administrative activities on individual nodes. The Web user interface of the ILB presents data from the primary and from the worker nodes in a scaled-out cluster in a unified display(single pane of glass).

Application Functional Components

The functional components of a vRealize Log Insight instance interact with each other to perform the following operations:

  • Analyze logging data that is ingested from the components of a data center
  • Visualize the results in a Web browser, or support results query using API calls.
Figure 2. vRealize Log Insight Logical Node Architecture

Each Log Insight node supports an API or UI access point, performs log collection, and participates in load balancing and load balancing leader election.

The vRealize Log Insight components perform these tasks:

Product/Admin UI and API
The UI server is a Web application that serves as both user and administration interface. The server hosts the API for accessing collected statistics.
Syslog Ingestion
Responsible for ingesting syslog logging data.
Log Insight Native Ingestion API (CFAPI) Ingestion
Responsible for ingesting logging data over the ingestion API by using one of the following methods:
  • vRealize Log Insight agent that has been deployed or preconfigured on SDDC components.
  • Log Insight Importer that is used for ingestion of non-real time data.
Integration Load Balancing and Election
Responsible for balancing incoming UI and API traffic, and incoming data ingestion traffic.
The Integrated Load Balancer is a Linux Virtual Server (LVS) that is built in the Linux Kernel for Layer 4 load balancing. Each node of vRealize Log Insight contains a service running the Integrated Load Balancer, but only a single node functions as the leader at all times. In a single-node vRealize Log Insight instance, this is always the primary node. In a scaled-out vRealize Log Insight cluster, this role can be inherited by any of the available nodes during the election process. The leader periodically performs health checks to determine whether a re-election process is required for the cluster.
Configuration Database
Stores configuration information about the vRealize Log Insight nodes and cluster. The information that is stored in the database is periodically replicated to all available vRealize Log Insight nodes.
Log Repository
Stores logging data that is ingested in vRealize Log Insight. The logging repository is local to each node and not replicated. If a node is offline or removed, the logging data which is stored on that node becomes inaccessible. In environments where an ILB is configured, incoming logging data is evenly distributed across all available nodes.

When a query arrives from the ILB, the vRealize Log Insight node holding the ILB leader role delegates the query to any of the available nodes in the cluster.

Authentication Models

You can configure vRealize Log Insight user authentication to utilize one or more of the following authentication models:

  • Microsoft Active Directory
  • Local Accounts
  • VMware Identity Manager

Content Packs

Content packs help add valuable troubleshooting information in to vRealize Log Insight. They provide structure and meaning to raw logging data that is collected from either a vRealize Log Insight agent, vRealize Log Insight Importer or a syslog stream. They add vRealize Log Insight agent configurations, providing out-of-the-box parsing capabilities for standard logging directories and logging formats, along with dashboards, extracted fields, alert definitions, query lists, and saved queries from the logging data related to a specific product in vRealize Log Insight. Visit Log Insight Content Pack Marketplace or the VMware Solutions Exchange.

Integration with vRealize Operations Manager

The integration of vRealize Log Insight with vRealize Operations Manager provides data from multiple sources to a central place for monitoring the SDDC. The integration has the following advantages:

  • vRealize Log Insight sends notification events to vRealize Operations Manager.
  • vRealize Operations Manager can provide the inventory map of any vSphere object to vRealize Log Insight. In this way, you can view log messages from vRealize Log Insight in the vRealize Operations Manager Web user interface, taking you either directly to the object itself or to the location of the object within the environment.
  • Access to the vRealize Log Insight user interface is embedded in the vRealize Operations Manager user interface .


vRealize Log Insight supports data archiving on an NFS shared storage that the vRealize Log Insight nodes can access. However, vRealize Log Insight does not manage the NFS mount used for archiving purposes. vRealize Log Insight also does not perform cleanup of the archival files.

The NFS mount for archiving can run out of free space or become unavailable for a period of time greater than the retention period of the virtual appliance. In that case, vRealize Log Insight stops ingesting new data until the NFS mount has enough free space or becomes available, or until archiving is disabled. If archiving is enabled, system notifications from vRealize Log Insight sends you an email when the NFS mount is about to run out of space or is unavailable. 


You back up each vRealize Log Insight cluster using traditional virtual machine backup solutions that are compatible with VMware vSphere Storage APIs – Data Protection (VADP).

Consolidated vRealize Log Insight Deployment

Because of its scope, the VMware Validated Design for Workload and Management Consolidation implements a small-scale vRealize Log Insight deployment. This implementation is designed to maintain the ability to scale up to the larger VMware Validated Design for Software-Defined Data Center. The validated design uses an integrated load balancer on top of the single primary node so that you can scale out the cluster as required while minimizing downtime.

Figure 3. Consolidated vRealize Log Insight