Data archiving preserves old logs that might otherwise be removed from the vRealize Log Insight virtual appliance due to storage constraints. See Enable or Disable Data Archiving in vRealize Log Insight. You can use the command line to import logs that have been archived in vRealize Log Insight.

About this task

Note:

Although vRealize Log Insight can handle historic data and real-time data simultaneously, you are advised to deploy a separate instance of vRealize Log Insight to process imported log files.

Prerequisites

  • Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

  • Verify that you have access to the NFS server where vRealize Log Insight logs are archived.

  • Verify that the vRealize Log Insight virtual appliance has enough disk space to accommodate the imported log files.

    The minimum free space in the /storage/core partition on the virtual appliance must equal approximately 10 times the size of the archived log that you want to import.

Procedure

  1. Establish an SSH connection to the vRealize Log Insight vApp and log in as the root user.
  2. Mount the shared folder on the NFS server where the archived data resides.
  3. To import a directory of archived vRealize Log Insight logs, run the following command.
    /usr/lib/loginsight/application/bin/loginsight repository import Path-To-Archived-Log-Data-Folder.
    Note:

    Importing archived data might take a long time, depending on the size of the imported folder.

  4. Close the SSH connection.

What to do next

You can search, filter, and analyze the imported log events.