After installation, the liagent.ini file contains pre-configured default settings for the Log Insight Windows Agent.

Log Insight Windows Agent liagent.ini Default Configuration

If you use non-ASCII names and values, save the configuration as UTF-8.

If you are using central configuration, the final configuration is this file joined with settings from the server to form the liagent-effective.ini file.

You may find it more efficient to configure the settings from the server's agents page.

; Client-side configuration of VMware Log Insight Agent.
; See liagent-effective.ini for the actual configuration used by VMware Log Insight Agent.

; Log Insight server hostname or ip address
; If omitted the default value is LOGINSIGHT

;Enables or disables centralized configuration from the vRealize Log Insight server. 
;When enabled, agent configuration changes made to the liagent.ini file on the server
;are joined with the settings in this file. to this agent. Accepted values are yes or no and  0 or 1. 
;The default is yes.

; Set protocol to use:
; cfapi - Log Insight REST API
; syslog - Syslog protocol
; If omitted the default value is cfapi

; Log Insight server port to connect to. If omitted the default value is:
; for syslog: 514
; for cfapi without ssl: 9000
; for cfapi with ssl: 9543

;ssl - enable/disable SSL. Applies to cfapi protocol only.
; Possible values are yes or no. If omitted the default value is no.

; Time in minutes to force reconnection to the server
; If omitted the default value is 30

;max_disk_buffer - max disk usage limit (data + logs) in MB:
; 100 - 2000 MB, default 200

;debug_level - the level of debug messages to enable:
;   0 - no debug messages
;   1 - trace essential debug messages
;   2 - verbose debug messages (will have negative impact on performance)
;The interval in minutes to print statistics

; Do not change this parameter

; Enable automatic update of the agent. If enabled:
; the agent will silently check for updates from the server and
; if available will automatically download and apply the update.





Default Value




IP address or host name of the vRealize Log Insight virtual appliance.

The default is loginsight.



Enable or disable centralized configuration for this agent. When centralized configuration is disabled, the agent ignores configuration provided by the vRealize Log Insight server. Accepted values are yes, no,1, or 0. The default value is yes.



Protocol that the agent uses to send events to the vRealize Log Insight server. The possible values are cfapi and syslog.

The default is cfapi.


9543, 9000, 6514, and 514

Communication port that the agent uses to send events to the vRealize Log Insight or third party server. By default the agent uses the appropriate port based on the options that are set for SSL and the protocol. See default port values provided in the list below. You need to specify the port option only if it's different from these defaults.

  • cfapi with SSL enabled: 9543

  • cfapi with SSL disabled: 9000

  • syslog with SSL enabled: 6514

  • syslog with SSL disabled: 514



Enables or disables SSL. The default value is yes.

When ssl is set to yes, if you do not set a value for the port, the port is automatically picked up as 9543.



The maximum disk space in MB that the Log Insight Windows Agent uses to buffer events and its own logs.

When the specified max_disk_buffer is reached, the agent begins to drop new incoming events.



Defines the log details level. See Define Log Details Level in the Log Insight Agents.


Application, Security, System

The Application, Security, and System Windows Event Log channels are commented by default; the Log Insight Windows Agent does not collect logs from these channels.

See Collect Events from Windows Events Channels.



For agents that use the syslog protocol, allows the agent to collect and send raw syslog events The default is no, which means collected events are transformed with user-specified syslog attributes. Enable this option to collect events without any syslog transformations.

Accepted values are yes or 1 and no or 0.