What are the pre-requisites for creating Windows Template and Linux Template having vRealize log insight agent in it, so that whenever that template is called the Log insight agent also gets deployed and started to send logs to vRLI server.

[JaskaranJutla]

Also, In one of my infrastructure, if I used the method of pushing vRealize log insight agent via Linux and windows templates using SSL, the problem occurring when a new VM is created having log insight agent in it, It first starts reflecting in vRLI server UI. But after some while, the status of that VM shows "disconnected", and after sometimes, it again comes "Active". When I investigation, I came to the conclusion that the liupdaterd service in that VM is stopping frequently. So what could be the possible cause of this? and Also, could someone helps me in getting the solution that how can I configure my template to push vRealize log insight agent to VM created from that template and sending logs to my vRLI Server?

[daphnissov]

You've cross-posted here which you don't need to do. The vRLI agent shouldn't be installed in a template because of the unique ID it generates. You'll need to install the agent fresh upon a new VM deployment from a template. Since the agent is stored on the appliance, you can easily download this from that appliance and install it locally. If you want to see a sample script, you can check out the vRA blueprints I built to do this.

Windows

Linux

As far as why the status shows "disconnected" intermittently, that's something that would have to be troubleshot. I've never seen that in hundreds of agents. It might also require you to open an SR if you haven't already.

[JaskaranJutla]

We are pushing the vRLI agents to the VM's from Template... That's works good on VM's and VRLI is able to capture all the events and logs from those VM's as well.... So, what all consequences comes if we continue to follow this method..

Also regarding status "disconnected" it is only occuring in Linux machined not on Windows... In windows it is working fine....

[daphnissov]

If it's working already, I don't see there are any consequences unless there's something in your workflow that isn't happening the way you want. As far as the "disconnected" status, you may need to open a support case and gather logs. It sounds like an interruption is occurring between these clients and the vRLI server.

[JaskaranJutla]

Thank you for your help in that.. I have another query regarding vRLI 4.5, i.e. In Event forwarding we have to add the destination server where we will be sending the logs from vRLI to third party syslog server. So there we add the Disk Buffer size i.e Max = 2000MB, So if i am adding same destination server multiple times with different filters in each, and i am giving disk buffer of 2000MB in each, then will each destination i have created will have its own 2000MB of disk buffer? or the total will be 2000MB irrespective of the times we add the same destination?