Download the vRealize Log Insight virtual appliance. VMware distributes the vRealize Log Insight virtual appliance as an .ova file. Deploy the vRealize Log Insight virtual appliance by using the vSphere Client.

Prerequisites

  • Verify that you have a copy of the vRealize Log Insight virtual appliance .ova file.

  • Verify that you have permissions to deploy OVF templates to the inventory.

  • Verify that your environment has enough resources to accommodate the minimum requirements of the vRealize Log Insight virtual appliance. See Minimum Requirements.

  • Verify that you have read and understand the virtual appliance sizing recommendations. See Sizing the Log Insight Virtual Appliance.

Procedure

  1. In the vSphere Client, select File > Deploy OVF Template.
  2. Follow the prompts in the Deploy OVF Template wizard.
  3. On the Select Configuration page, select the size of the vRealize Log Insight virtual appliance based on the size of the environment for which you intend to collect logs.

    Small is the minimum requirement for production environments.

    vRealize Log Insight provides preset VM sizes that you can select from to meet the ingestion requirements of your environment. These presets are certified size combinations of compute and disk resources, though you can add extra resources afterward. A small configuration consumes the fewest resources while remaining supported. An extra small configuration is suitable only for demos.

    Option

    Log Ingest Rate

    Virtual CPUs

    Memory

    IOPS

    Syslog Connections (Active TCP Connections)

    Events per Second

    Extra Small

    6 GB/day

    2

    4 GB

    75

    20

    400

    Small

    30 GB/day

    4

    8 GB

    500

    100

    2000

    Medium

    75 GB/day

    8

    16 GB

    1000

    250

    5000

    Large

    225 GB/day

    16

    32 GB

    1500

    750

    15,000

    Note:

    You can use a syslog aggregator to increase the number of syslog connections that send events to vRealize Log Insight. However, the maximum number of events per second is fixed and does not depend on the use of a syslog aggregator. A vRealize Log Insight instance cannot be used as a syslog aggregator.

    Note:

    If you select Large, you must upgrade the virtual hardware on the vRealize Log Insight virtual machine after the deployment.

  4. On the Select Storage page, select a disk format.
    • Thick Provision Lazy Zeroed creates a virtual disk in a default thick format. Space required for the virtual disk is allocated when the virtual disk is created. The data remaining on the physical device is not erased during creation, but is zeroed out on demand later, on first write from the virtual appliance.

    • Thick Provision Eager Zeroed creates a type of thick virtual disk that supports clustering features such as Fault Tolerance. Space required for the virtual disk is allocated at creation time. In contrast to the flat format, the data remaining on the physical device is zeroed out when the virtual disk is created. It might take much longer to create disks in this format than to create other types of disks.

      Important:

      Deploy the vRealize Log Insight virtual appliance with thick provisioned eager zeroed disks whenever possible for better performance and operation of the virtual appliance.

    • Thin Provision creates a disk in thin format. The disk grows as the data saved on it grows. If your storage device does not support thick provisioning disks or you want to conserve unused disk space on the vRealize Log Insight virtual appliance, deploy the virtual appliance with thin provisioned disks.

    Note:

    Shrinking disks on the vRealize Log Insight virtual appliance is not supported and might result in data corruption or data loss.

  5. (Optional) : On the Setup networks page, set the networking parameters for the vRealize Log Insight virtual appliance.

    If you do not provide network settings, such as an IP address, DNS servers, and gateway information, vRealize Log Insight utilizes DHCP to set those settings.

    Caution:

    Do not specify more than two domain name servers. If you specify more than two domain name servers, all configured domain name servers are ignored in the vRealize Log Insight virtual appliance.

    Use a comma-separated list to specify domain name servers.

  6. (Optional) : On the Customize template page, set network properties if you are not using DHCP.
  7. (Optional) : On the Customize template page, select Other Properties and set the root password for the vRealize Log Insight virtual appliance.

    The root password is required for SSH. You can also set this password through the VMware Remote Console.

  8. Follow the prompts to complete the deployment.

    For information on deploying virtual appliances, see the User's Guide to Deploying vApps and Virtual Appliances.

    After you power on the virtual appliance, an initialization process begins. The initialization process takes several minutes to complete. At the end of the process, the virtual appliance restarts.

  9. Navigate to the Console tab and check the IP address of the vRealize Log Insight virtual appliance.

    IP Address Prefix

    Description

    https://

    The DHCP configuration on the virtual appliance is correct.

    http://

    The DHCP configuration on the virtual appliance failed.

    1. Power off the vRealize Log Insight virtual appliance.

    2. Right-click the virtual appliance and select Edit Settings.

    3. Set a static IP address for the virtual appliance.

What to do next

  • If you want to configure a standalone vRealize Log Insight deployment, see Configure New Log Insight Deployment.

    The vRealize Log Insight Web interface is available at https://log-insight-host/ where log-insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.