During deployment of the vRealize Log Insight virtual appliance, you can select from preset configuration sizes according to the ingestion requirements for your environment. The presets are certified size combinations of compute and disk resources, though you can add extra resources afterward. A small configuration, described in the following table, consumes the fewest resources while remaining supported. An extra-small configuration is also available, but it is suitable only for demos.
Root Account – Unless you specify a root password or use guest customization during the deployment of the OVA, the default credentials for the root user on the vRealize Log Insight virtual appliance are root/<blank>. You are prompted to change the root account password when you first access the vRealize Log Insight virtual appliance console.
User accounts that you create in vRealize Log Insight 3.3 and later require a strong password. The password must be at least 8 characters long and contain one uppercase character, one lowercase character, one number, and one special character.
Note – SSH is disabled until you set the root password.
Vcenter AD Account
To pull events, tasks, and alarms data from a vCenter Server, you must provide a set of user credentials for that vCenter Server. The minimum role required to register and unregister vRealize Log Insight with a vCenter Server is Read-only. The role must be set at the vCenter Server level and propagated to child objects. To configure ESXi hosts that a vCenter Server manages, vRealize Log Insight requires additional privileges.
vSphere ESXi AD Account
vSphere ESXi 6.0 update 1 or later is required to establish SSL connections to vRealize Log Insight.
Network Port Requirements
Sizing the vRealize Log Insight Virtual Appliance
You can change the appliance settings to meet the needs of the environment for which you intend to collect logs during deployment.
vRealize Log Insight provides preset VM (virtual machine) sizes that you can select from to meet the ingestion requirements of your environment. These presets are certified size combinations of compute and disk resources, though you can add extra resources afterward. A small configuration consumes the fewest resources while remaining supported. An extra small configuration is suitable only for demos.
You can use a syslog aggregator to increase the number of syslog connections that send events to vRealize Log Insight. However, the maximum number of events per second is fixed and does not depend on the use of a syslog aggregator. A vRealize Log Insight instance cannot be used as a syslog aggregator.
The sizing is based on the following assumptions.
- Each virtual CPU is at least 2 GHz.
- Each ESXi host sends up to 10 messages per second with an average message size of 170 bytes/message, which is roughly equivalent to 150 MB/day/host.
Use a medium configuration, or larger, for the master and worker nodes in a vRealize Log Insight cluster. The number of events per second increases linearly with the number of nodes. For example, in a cluster of 3-12 nodes (clusters must have a minimum of three nodes), the Internet in a 12-node cluster is 180,000 events per second (EPS), or 2.7 TB of events per day.