Download the vRealize Log Insight virtual appliance. VMware distributes the vRealize Log Insight virtual appliance as an .ova file. Deploy the vRealize Log Insight virtual appliance by using the vSphere Client.

Prerequisites

  • Verify that you have a copy of the vRealize Log Insight virtual appliance .ova file.
  • Verify that you have permissions to deploy OVF templates to the inventory.
  • Verify that your environment has enough resources to accommodate the minimum requirements of the vRealize Log Insight virtual appliance. See Minimum Requirements.
  • Verify that you have read and understand the virtual appliance sizing recommendations. See Sizing the Log Insight Virtual Appliance.

Procedure

  1. In the vSphere Client, select File > Deploy OVF Template.
  2. Follow the prompts in the Deploy OVF Template wizard.
  3. On the Select Configuration page, select the size of the vRealize Log Insight virtual appliance based on the size of the environment for which you intend to collect logs.
    Small is the minimum requirement for production environments.
    vRealize Log Insight provides preset VM (virtual machine) sizes that you can select from to meet the ingestion requirements of your environment. These presets are certified size combinations of compute and disk resources, though you can add extra resources afterward. A small configuration consumes the fewest resources while remaining supported. An extra small configuration is suitable only for demos.
    Preset Size Log Ingest Rate Virtual CPUs Memory IOPS Syslog Connections (Active TCP Connections) Events per Second
    Extra Small 6 GB/day 2 4 GB 75 20 400
    Small 30 GB/day 4 8 GB 500 100 2000
    Medium 75 GB/day 8 16 GB 1000 250 5000
    Large 225 GB/day 16 32 GB 1500 750 15,000
    You can use a syslog aggregator to increase the number of syslog connections that send events to vRealize Log Insight. However, the maximum number of events per second is fixed and does not depend on the use of a syslog aggregator. A vRealize Log Insight instance cannot be used as a syslog aggregator.
    Note: If you select Large, you must upgrade the virtual hardware on the vRealize Log Insight virtual machine after the deployment.
  4. On the Select Storage page, select a disk format.
    • Thick Provision Lazy Zeroed creates a virtual disk in a default thick format. Space required for the virtual disk is allocated when the virtual disk is created. The data remaining on the physical device is not erased during creation, but is zeroed out on demand later, on first write from the virtual appliance.
    • Thick Provision Eager Zeroed creates a type of thick virtual disk that supports clustering features such as Fault Tolerance. Space required for the virtual disk is allocated at creation time. In contrast to the flat format, the data remaining on the physical device is zeroed out when the virtual disk is created. It might take much longer to create disks in this format than to create other types of disks.
      Important: Deploy the vRealize Log Insight virtual appliance with thick provisioned eager zeroed disks whenever possible for better performance and operation of the virtual appliance.
    • Thin Provision creates a disk in thin format. The disk expands as the amount of data saved on it increases. If your storage device does not support thick provisioning disks or you want to conserve unused disk space on the vRealize Log Insight virtual appliance, deploy the virtual appliance with thin provisioned disks.
    Note: Shrinking disks on the vRealize Log Insight virtual appliance is not supported and might result in data corruption or data loss.
  5. (Optional) On the Select networks page, set the networking parameters for the vRealize Log Insight virtual appliance. You can select the IPv4 or IPv6 protocol.
    If you do not provide network settings, such as an IP address, DNS servers, and gateway information, vRealize Log Insight uses DHCP to set those settings.
    Caution: Do not specify more than two domain name servers. If you specify more than two domain name servers, all configured domain name servers are ignored in the vRealize Log Insight virtual appliance.

    Use a comma-separated list to specify domain name servers.

  6. (Optional) On the Customize template page, set network properties if you are not using DHCP.
    Under Application, select the Prefer IPv6 addresses check box if you want to run the virtual machine in a dual stack network.
    Caution: Do not select the Prefer IPv6 addresses check box if you want to use pure IPv4 even with IPv6 supported in your network. Select the check box only if your network has a dual stack or pure stack support for IPv6.
  7. (Optional) On the Customize template page, select Other Properties and set the root password for the vRealize Log Insight virtual appliance.
    The root password is required for SSH. You can also set this password through the VMware Remote Console.
  8. Follow the prompts to complete the deployment.

    For information on deploying virtual appliances, see the User's Guide to Deploying vApps and Virtual Appliances.

    After you power on the virtual appliance, an initialization process begins. The initialization process takes several minutes to complete. At the end of the process, the virtual appliance restarts.
  9. Navigate to the Console tab and verify the IP address of the vRealize Log Insight virtual appliance.
    IP Address Prefix Description
    https:// The DHCP configuration on the virtual appliance is correct.
    http:// The DHCP configuration on the virtual appliance failed.
    1. Power off the vRealize Log Insight virtual appliance.
    2. Right-click the virtual appliance and select Edit Settings.
    3. Set a static IP address for the virtual appliance.

What to do next

  • If you want to configure a standalone vRealize Log Insight deployment, see Configure New Log Insight Deployment.

    The vRealize Log Insight Web interface is available at https://log-insight-host/ where log-insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.