vRealize Log Insigh 4.6 Cluster with Forwarders Design

[alvarojsoto]

Folks:

I'm designing a vRealize Log Insigh cluster for 10 + Sites. I'm set on creating two main clusters WITH forwarder clusters on the two main Data Centers and forwarder clusters on the rest of the sites. The question I have are:

1. On each Data Center I will have 1 "worker" cluster and 1 "forwarder" cluster for a total of 5 VRL appliances. The "worker cluster will have 3 VRL nodes and the "forwarder" cluster 2 nodes. Is it posible to have a "forwarder" cluster with 2 nodes or do I need to have 3?

2. Can the "fowarder" cluster in the data center have different computer and storage than the "worker" cluster? I want to have the 3 nodes configure as large and the fowarder cluster on the same data center as medium.

3. I plan on using Cross-forwarding between the two main data centers "worker" clusters, so the 2 "worker" clusters will be mirroring each other. Is it posible to have more than 2 clusters on Cross-forwarding?

4. The remote sites forwarding clusters will vary in compute sizes since I will ajust them to meet the LI. Is that supported or do all appliances that are somewhat connected have to have the same size?

Regards,

[stephenyu05]

i am looking for this design

The design is extended through the addition of multiple forwarder clusters at remote sites or clusters. Each forwarder cluster is configured to forward all its log messages to the main cluster and users connect to the main cluster, taking advantage of CFAPI for compression and resilience on the forwarding path. Forwarder clusters configured as top-of-rack can be configured with a larger local retention.

Cross-Forwarding Central for Redundancy

This vRealize Log Insight deployment scenario includes a cluster with forwarder that is extended and mirrored. Two main clusters are used for indexing, storage, and query. One main cluster is in each data center. Each is front-ended with a pair of dedicated forwarder clusters. All log sources from all top-of-rack aggregations concentrate at the forwarder clusters. You can independently query the same logs on both retention clusters.