By default, the vRealize Log Insight virtual appliance uses the preset values for small configurations, which have 4 vCPUs, 8GB of virtual memory, and 510GB of disk space provisioned. vRealize Log Insight uses 100GB of the disk space to store raw data, index, metadata, and other information.

Standalone Deployment

You can change the appliance settings to meet the needs of the environment for which you intend to collect logs during deployment.

vRealize Log Insight provides preset VM sizes that you can select from to meet the ingestion requirements of your environment. These are certified size combinations of compute and disk resources, though you can add extra resources afterward. A small configuration consumes the least resources while remaining supported. An extra small configuration is suitable only for demos.

Option

Log Ingest Rate

vCPUs

Memory

IOPS

Syslog Connections

Events per Second

Extra Small

6GB/day

2

4GB

75

20

400

Small

30GB/day

4

8GB

500

100

2000

Medium

75GB/day

8

16GB

1000

250

5000

Large

225GB/day

16

32GB

1500

750

15,000

Note:

You can use a syslog aggregator to increase the number of syslog connections that send events to vRealize Log Insight. However, the maximum number of events per second is fixed and does not depend on the use of a syslog aggregator. A vRealize Log Insight instance cannot be used as a syslog aggregator.

The sizing is based on the following assumptions.

  • Each vCPU is at least 2GHz.

  • Each ESXi host sends up to 10 messages per second with an average message size of 170 bytes/message. This is roughly equivalent to 150MB/day/host.

Note:

For large installations, you must upgrade the virtual hardware version of the vRealize Log Insight virtual machine. vRealize Log Insight supports virtual hardware version 7 or later. Virtual hardware version 7 can support up to 8 vCPUs. Therefore, you must upgrade to virtual hardware version 8 or later for ESXi 5.x if you plan to provision 16 vCPUs. You use the vSphere Client to upgrade the virtual hardware. If you want to upgrade virtual hardware to the latest version, read and understand the information in the VMware knowledge base article Upgrading a virtual machine to the latest hardware version (1010675) .

Cluster Deployment

Use a medium configuration, or larger, for the master and worker nodes in a vRealize Log Insight cluster. The number of events per second increases linearly with the number of nodes. For example, in a cluster of 3-12 nodes (2 nodes are not supported), the net in a 12 node cluster is 180,000 events per second (EPS) or 2.7 TB of events per day.

Reducing the Memory Size

If you want to use the Extra Small version of the appliance on your laptop, but the laptop does not have enough memory, you can reduce the memory size to 2GB.