vRealize Log Insight collects data over the syslog protocol and HTTP; can connect to vCenter Server to collect events, tasks, and alarms data; and can integrate with vRealize Operations to send notification events and enable launch in context. Check the VMware vRealize Log Insight Release Notes for latest updates on supported product versions.

Virtual Appliance Deployment

You must deploy the vRealize Log Insight virtual appliance using vSphere. Always use a vSphere Client to connect to a vCenter Server. The vRealize Log Insight virtual appliance is deployed on an ESX/ESXi host version 5.0 or later that is managed by vCenter Server version 5.0 or later.

Syslog Feeds

vRealize Log Insight collects and analyzes syslog data over the following ports and protocols:

  • 514/UDP
  • 514/TCP
  • 1514/TCP (SSL)

You must configure environment components such as operating systems, applications, storage, firewalls, and network devices to push their syslog feeds to vRealize Log Insight.

API Feeds

The vRealize Log Insight Ingestion API collects data over the following ports and protocols.
  • 9000/TCP
  • 9543/TCP (SSL)

vSphere Integration

You can configure vRealize Log Insight to pull data for tasks, events, and alarms that occurred in one or more vCenter Server instances. vRealize Log Insight uses the vSphere API to connect to vCenter Server systems and collect data.

You can configure ESXi hosts to forward syslog data to vRealize Log Insight.

For compatibility information with specific versions of vCenter Server and ESXi, see the VMware Product Interoperability Matrixes.

For information about connecting to a vSphere environment, see Connect vRealize Log Insight to a vSphere Environment.

vRealize Operations Integration

vRealize Log Insight and vRealize Operations vApp or Installable can be integrated in two independent ways.

All supported versions of vRealize Operations support notifications as well as Launch in Context.