Data archiving preserves old logs that might otherwise be removed from an index partition after the retention period. See Data Archiving. You can use the command line to import logs that have been archived in vRealize Log Insight.

Note: Although vRealize Log Insight can handle historic data and real-time data simultaneously, you are advised to deploy a separate instance of vRealize Log Insight to process imported log files.

Prerequisites

  • Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.
  • Verify that you have access to the NFS server where vRealize Log Insight logs are archived.
  • Verify that the vRealize Log Insight virtual appliance has enough disk space to accommodate the imported log files.

    The minimum free space in the /storage/core partition on the virtual appliance must equal approximately 10 times the size of the archived log that you want to import.

Procedure

  1. Establish an SSH connection to the vRealize Log Insight vApp and log in as the root user.
  2. Mount the shared folder on the NFS server where the archived data resides.
  3. To import a directory of archived vRealize Log Insight logs, run the following command. 
    /usr/lib/loginsight/application/bin/loginsight repository import Path-To-Archived-Log-Data-Folder.
    Note:
    • To avoid the modification of the timestamp of the directory to be imported, ensure that this command is executed from a directory other than the one you want to import. Running the command from the directory you want to import results in the creation of a JavaClient.log file and an update of the directory's modification timestamp.
    • Importing archived data might take a long time, depending on the size of the imported folder.
  4. Close the SSH connection.

What to do next

You can search, filter, and analyze the imported log events.