After installation, the liagent.ini file contains pre-configured default settings for the Log Insight Windows Agent.

Log Insight Windows Agent liagent.ini Default Configuration

If you use non-ASCII names and values, save the configuration as UTF-8.

The final configuration is this file joined with settings from the server to form the liagent-effective.ini file.

You may find it more efficient to configure the settings from the server's agents page.

; Client-side configuration of VMware Log Insight Agent.
; See liagent-effective.ini for the actual configuration used by VMware Log Insight Agent.

[server]
; Log Insight server hostname or ip address
; If omitted the default value is LOGINSIGHT
;hostname=LOGINSIGHT

; Set protocol to use:
; cfapi - Log Insight REST API
; syslog - Syslog protocol
; If omitted the default value is cfapi
;
;proto=cfapi

; Log Insight server port to connect to. If omitted the default value is:
; for syslog: 514
; for cfapi without ssl: 9000
; for cfapi with ssl: 9543
;port=9000

;ssl - enable/disable SSL. Applies to cfapi protocol only.
; Possible values are yes or no. If omitted the default value is no.
;ssl=no

; Time in minutes to force reconnection to the server
; If omitted the default value is 30
;reconnect=30

[storage]
;max_disk_buffer - max disk usage limit (data + logs) in MB:
; 100 - 2000 MB, default 200
;max_disk_buffer=200

[logging]
;debug_level - the level of debug messages to enable:
;   0 - no debug messages
;   1 - trace essential debug messages
;   2 - verbose debug messages (will have negative impact on performance)
;debug_level=0
;
;The interval in minutes to print statistics
;stats_period=15

[update]
; Do not change this parameter
package_type=msi

; Enable automatic update of the agent. If enabled:
; the agent will silently check for updates from the server and
; if available will automatically download and apply the update.
;auto_update=yes

[winlog|Application]
channel=Application
raw_syslog=no

[winlog|Security]
channel=Security

[winlog|System]
channel=System
 

Parameter

Default Value

Description

proto

cfapi

Protocol that the agent uses to send events to the vRealize Log Insight server. The possible values are cfapi and syslog.

The default is cfapi.

hostname

LOGINSIGHT

IP address or host name of the vRealize Log Insight virtual appliance.

The default is loginsight.

port

9543, 9000, 6514, and 514

Communication port that the agent uses to send events to the vRealize Log Insight or third party server. By default the agent uses the appropriate port based on the options that are set for SSL and the protocol. See default port values provided in the list below. You need to specify the port option only if it's different from these defaults.

ssl

yes

Enables or disables SSL. The default value is yes.

When ssl is set to yes, if you do not set a value for the port, the port is automatically picked up as 9543.

max_disk_buffer

200

The maximum disk space in MB that the Log Insight Windows Agent uses to buffer events and its own logs.

When the specified max_disk_buffer is reached, the agent begins to drop new incoming events.

debug_level

0

Defines the log details level. See Define Log Details Level in the Log Insight Agents.

channel

Application, Security, System

The Application, Security, and System Windows Event Log channels are commented by default; the Log Insight Windows Agent does not collect logs from these channels.

See Collect Events from Windows Events Channels.

raw_syslog

No

For agents that use the syslog protocol, allows the agent to collect and send raw syslog events The default is no, which means collected events are transformed with user-specified syslog attributes. Enable this option to collect events without any syslog transformations.

Accepted values are yes or 1 and no or 0.