You can configure a vRealize Log Insight server to forward incoming log events to a syslog or Ingestion API target.

Use log forwarding to send filtered or tagged logs to one or more remote destinations such as vRealize Log Insight or syslog or both. Log forwarding can be used to support existing logging tools such as SIEM and to consolidate logging over different networks such as DMZ or WAN.

Log forwarders can be standalone or clustered, but a log forwarder is a separate instance from the remote destination. Instances configured for log forwarding also store logs locally and can be used to query data.

The operators you use to create filters on the Log Forwarding page are different from the filters used on the interactive analytics page. See Using Log Management Filters in Interactive Analytics for more information about using the Run in Interactive Analytics menu item to preview the results of your log filter.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a Super Admin user, or a user associated with a role that has the relevant permissions. See Create and Modify Roles for more information. The URL format of the web user interface is https://log-insight-host, where log-insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.

Verify that the destination can handle the number of logs that are forwarded. If the destination cluster is much smaller than the forwarding instance, some logs might be dropped.

Procedure

  1. Navigate to the Administration tab.
  2. Under Management, click Log Management and then click Log Forwarding.
  3. Click ""New Destination and provide the following information.
    Option Description
    Name A unique name for the new destination.
    Host The IP address or fully qualified domain name.
    Caution: A forwarding loop is a configuration in which a vRealize Log Insight cluster forwards logs to itself, or to another cluster, which then forwards the logs back to the original cluster. Such a loop might create an indefinite number of copies of each forwarded log. The vRealize Log Insight Web interface does not permit you to configure a log to be forwarded to itself. But vRealize Log Insight is not able to prevent an indirect forwarding loop, such as vRealize Log Insight cluster A forwarding to cluster B, and B forwarding the same logs back to A. When creating forwarding destinations, take care not to create indirect forwarding loops.
    Protocol

    Ingestion API, syslog, or RAW. The default value is Ingestion API (CFAPI).

    When logs are forwarded using the Ingestion API, the log's original source is preserved in the source field. When logs are forwarded using syslog, the log's original source is lost and the receiver can record the message's source as the vRealize Log Insight forwarder's IP address or hostname. When logs are forwarded using RAW, the behavior is similar to syslog, but syslog RFC-compliance is not ensured. RAW forwards a log exactly the way it is received, without a custom syslog header added by vRealize Log Insight. This protocol is useful for third-party destinations, because they expect syslog events in their original form.

    Note:
    The source field might have different values depending on the protocol selected on the Log Forwarder:
    1. For the ingestion API, the source is the initial sender's (the log originator) IP address.
    2. For syslog and RAW, the source is the Log Forwarder's vRealize Log Insight instance IP address. Also, the message text contains _li_source_path which points to the initial sender's IP address.
    Use SSL You can optionally secure the connection with SSL for the ingestion API or syslog. If the SSL certificate provided by the forwarding destination is untrusted, you can accept the certificate when you test or save this configuration.
    Tags You can optionally add tag pairs with predefined values. Tags permit you to more easily query logs. You can add multiple comma-separated tags.
    Forward Complementary tags You can select whether to forward complementary tags for syslog.

    Complementary tags are tags added by the cluster itself, such as 'vc_username' or 'vc_vmname.' and can be forwarded with the tags coming directly from sources. Complementary tags are always forwarded when Ingestion API is used.

    Transport Select a transport protocol for syslog. You can select UDP or TCP.
  4. To control which logs are forwarded, click "" Add Filter.
    Select fields and constraints to define the desired logs. Only static fields are available for use as filters. If you do not select a filter, all logs are forwarded. You can see the results of the filter you are building by clicking Run in Interactive Analytics.
    Operator Description
    Matches Finds strings that match the string and wildcard specification, where * means zero or more characters and ? means zero or any single character. Prefix and postfix globbing is supported.

    For example, *test* matches strings such as test123 or my-test-run.

    does not match Excludes strings that match the string and wildcard specification, where * means zero or more characters and ? means zero or any single character. Prefix and postfix globbing is supported.

    For example, test* excludes test123, but not mytest123. ?test* excludes test123 and xtest123, but not mytest123.
    starts with Finds strings that start with the specified character string.

    For example, test finds test123 or test, but not my-test123.

    does not start with Excludes strings that start with the specified character string.

    For example, test filters out test123, but not my-test123.

  5. (Optional) To modify the following forwarding information, click Show Advanced Settings.
    Option Description
    Port The port to which logs are sent on the remote destination. The default value is set based on the protocol. Do not change unless the remote destination listens on a different port.
    Worker Count The number of simultaneous outgoing connections to use. Set a higher worker count for a higher network latency to the forwarded destination and for a greater number of forwarded logs per second. The default value is 8.
  6. To verify your configuration, click Test.
  7. If the forwarding destination provides an untrusted SSL certificate, a dialog box appears with the details of the certificate. Click Accept to add the certificate to the truststores of all the nodes in the vRealize Log Insight cluster.
    If you click Cancel, the certificate is not added to the truststores and the connection with the forwarding destination fails. You must accept the certificate for a successful connection.
  8. Click Save.
    If you did not test the configuration and the destination provides an untrusted certificate, follow the instructions in step 7.

What to do next

You can edit or clone a log forwarding destination. If you edit the destination to change a log forwarder name, all statistics are reset.