VMware Aria Operations for Logs Preparations for Backing Up

You can perform full, differential, and incremental backups and restores of VMware Aria Operations for Logs VMs.

If resources are ready, back up all the nodes at the same time, to speed up the backup process. Verify that you increase the number of concurrent backups from one, which is the default. Linear backup is also supported but it slows down the restore operation.

Guidelines for Planning Backups

Guidelines for backing up VMware Aria Operations for Logs clusters in a new environment.

• Ensure that there are no configuration problems on the source and target sites before performing the backup and restore operations.

• During the backup operation, the memory usage can increase due to the VMware Aria Operations for Logs cluster usage. In some cases, the worker nodes might be disconnected for 1 to 3 minutes due to high memory usage. To reduce the memory throttling on VMware Aria Operations for Logs nodes, follow these guidelines:

  • Allocate additional memory over the VMware Aria Operations for Logs recommended configuration.

  • Schedule the recurring backups during off-peak hours.

• Deactivate quiesced snapshots, because VMware Aria Operations for Logs does not support them.

• The VMware Aria Operations for Logs server supports Linux and Windows agents.

  • If the agent configuration is created on the server side, a separate backup of the agent node is not required.

  • If you use the agent nodes for more than installing the agent software and if these nodes need a full backup, follow the same backup procedure as for any VM.

  • If the agent configuration is done on the client side on the agents, and if the agent nodes are used only to install VMware Aria Operations for Logs agent software, schedule a backup of the agent configuration file. Back up the liagent.ini file and replace the file on the recovered agent or Linux or Windows machine with the backup file.

• If concurrent backup is not possible, ensure that the VMware Aria Operations for Logs primary node is backed up first before the worker nodes. Worker nodes can be backed up in any order.

• Ensure that the backup frequency and backup types are selected based on the available resources and customer-specific requirements.

• Use the following guidelines when scheduling recurring backups.

  • For a reasonable loaded cluster setup, it might take a while for the first backup to finish irrespective of the tool.

  • The first backup is usually a full backup. Successive backups can be incremental or full backups. Successive backups finish relatively fast, compared to the first backup operation.

• Use static IP addresses for all nodes in a VMware Aria Operations for Logs cluster.
  • Using static IP addresses eliminates the need to update the IP addresses of VMware Aria Operations for Logs cluster nodes each time the IP address of a VMware Aria Operations for Logs node changes. 
  • VMware Aria Operations for Logs includes all node IP addresses in each cluster node configuration file at /storage/core/loginsight/config/loginsight-config.xml#<n> where <n> is the largest number.
  • Some products that integrate with VMware Aria Operations for Logs to feed their logs, use a fully qualified domain name (FQDN) or IP address as the syslog target. For example, vSphere ESXi, vSphere, and VMware Aria Operations use the nodes of the cluster master's or the load balancer's (if configured) FQDN or IP address as the syslog target.
• Use an FQDN for all nodes in the VMware Aria Operations for Logs cluster. 

  • For the primary node, when you use a load balancer, a fully resolvable FQDN is required. Otherwise, the ESXi hosts fail to feed the syslog messages to VMware Aria Operations for Logs or to any remote target. 

  • Using an FQDN saves time on post-restore and recovery configuration changes, assuming that the same FQDN can be resolved on the recovery site. 
  • For system alerts, VMware Aria Operations for Logs uses FQDN host names if available instead of IP addresses.  
  • Assuming that only underlying IP addresses change post-backup and recovery or disaster recovery operations, using FQDN eliminates the need to change the syslog target address (primary node FQDN or internal load balancer FQDN) on all the external devices feeding logs to the VMware Aria Operations for Logs cluster.
• Join requests from a VMware Aria Operations for Logs worker node should use the FQDN of the VMware Aria Operations for Logs primary node.
• Provide static IP addresses as well as optional virtual IP addresses for the load balancer. 
  • When configuring an integrated load balancer, provide the optional FQDN for the virtual IP address. This optional FQDN enables VMware Aria Operations for Logs to revert to the FQDN when an IP address is not reachable for any reason.