The vRealize Log Insight cluster consists of one primary node and two worker nodes behind a load balancer.

You enable the integrated load balancer (ILB) on the 3-node cluster so that all log sources can address the cluster by its ILB. By using the ILB, you need not reconfigure all log sources with a new destination address in a future scale-out. Using the ILB also guarantees that vRealize Log Insight accepts all incoming ingestion traffic.

vRealize Log Insight users, using both the Web user interface or API, and clients, ingesting logs by using syslog or the Ingestion API, connect to vRealize Log Insight using the ILB address.

A vRealize Log Insight cluster can scale out to 12 nodes, that is, 1 primary and 11 worker nodes.

Table 1. Design Decisions on the Node Configuration of vRealize Log Insight
Decision ID Design Decision Design Justification Design Implication
SDDC-OPS-LOG-001 In each region, deploy vRealize Log Insight in a cluster configuration of 3 nodes with an integrated load balancer: one primary and two worker nodes.
  • Provides high availability.
  • Using the integrated load balancer prevents a single point of failure.
  • Using the integrated load balancer simplifies the vRealize Log Insight deployment and subsequent integration.
  • Using the integrated load balancer simplifies the vRealize Log Insight scale-out operations reducing the need to reconfigure existing logging sources.
  • You must deploy a minimum of 3 medium nodes.
  • You must size each node identically.
  • If the capacity of your vRealize Log Insight cluster must grow, identical capacity must be added to each node.
SDDC-OPS-LOG-002 Apply vSphere Distributed Resource Scheduler (DRS) anti-affinity rules to the vRealize Log Insight cluster components. Prevents the vRealize Log Insight nodes from running on the same ESXi host and risking the high availability of the cluster.
  • You must perform additional configuration to set up anti-affinity rules.
  • You can put in maintenance mode only a single ESXi host at a time in the management cluster of four ESXi hosts.