vRealize Log Insight collects log events from all management components in each region of the SDDC.

Logical Design

In the VMware Validated Design for Workload and Management Consolidation, deploy a single vRealize Log Insight instance that consists of a single primary node. This configuration provides single location of log data and accommodates the log ingestion rates generated from the management components.

Figure 1. Logical Design of vRealize Log Insight

In this design, vRealize Log Insight retrieves log information from all management components in the Consolidated SDDC. The Log Insight deployment consists of a single node according to the scale of the deployment.

Sources of Log Data

vRealize Log Insight collects logs as to provide monitoring information about the SDDC from a central location.

vRealize Log Insight collects log events from the following virtual infrastructure and cloud management components:

  • Consolidated cluster

    • Platform Services Controller

    • vCenter Server

    • ESXi hosts

  • NSX for vSphere for the consolidated cluster

    • NSX Manager

    • NSX Controller instances

    • NSX Edge services gateway instances

    • NSX universal distributed logical router instances

    • NSX distributed firewall ESXi kernel module

  • vRealize Suite Lifecycle Manager

  • vRealize Automation

    • vRealize Automation Appliance

    • vRealize IaaS Web Server

    • vRealize IaaS Management Server

    • vRealize IaaS DEM

    • vRealize IaaS Proxy Agents

    • vRealize Orchestrator (embedded in the vRealize Automation Appliance)

    • Microsoft SQL Server

  • vRealize Business

    • vRealize Business server

    • vRealize Business data collector

  • vRealize Operations Manager

    • Analytics cluster node

    • Remote collector