vRealize Log Insight Log Files

[BruceLeach]

Author : Sally Hehir

URL : http:////docs.vmware.com/en/vRealize-Log-Insight/4.6/com.vmware.log-insight.administration.doc/GUID-...

Topic Name : vRealize Log Insight Log Files

Publication Name : Administering vRealize Log Insight

Product/Version : vRealize Log Insight/4.6

Question :

Looking at the documentation for Log Insight, I don't see what the retention period is for it's own log files. 

[daphnissov]

It depends on the amount of data written to them. There's no set amount that equals.

[BruceLeach]

So the system logs roll over at a set size?  (I'm not talking about the logs it is collecting from other servers, I'm talking about it's local system logs.  Who's logged into Loginsight and when.  What changes were made?)

[daphnissov]

Yes, Log Insight system logs roll over at a set size or number. It's just like virtually every other piece of software out there. Otherwise, you have a full filesystem on your hands which no one wants to deal with.

[BruceLeach]

Thanks.  I haven't been able to find that documented on VMware's site.  Am I just being dumb, or is that specifically not documented and I have to log into the node and see what it's set at?  I'm asking as my company has regulations to keep this data for a set amount of time, and I need to have documentation for auditors.

[daphnissov · Accepted solution]

I don't know that any appliances/applications have this documented because no one could make a commitment on what it could store. On many Linux-based appliances it's usually something like 10 log files (or whatever log4j might have configured). Although it's strictly speaking not supported (I think, anyway), you could forward Log Insight's system logs to a separate vRLI instance. The appliance even has the vRLI agent installed upon it making it a simple matter to set up.

[BruceLeach]

Yep, that's what I was expecting... I'll have to dig through some configs and see if what is there is good enough for auditors, if not we'll get them pushed elsewhere and maintain them that way.  Thanks a lot for the assist.