Recently I was having a conversation with a colleague about the scratch location an ESXi host. The question that we were unclear on though, was whether or not - when an ESXi host is registered with Log Insight, is the scratch location now Log Insight? I've noticed that the scratch location isn't changed in vCenter (still /tmp/scratch because this is an SD install), but is that log data being sent to Log Insight?
The log persistence alarm goes away, which is why we ended up having this conversation . TIA!
Logs are still being stored locally on scratch (which, in your case, is RAM disk), but they're also being sent to vRLI. If you want them saved to a persistent location on ESXi in addition, you'll need to direct those logs to some other scratch location than a RAM disk. The choice is yours.
The scratch location on the ESXi is totally unrelated to loginsight. The scratch location is still required by the ESXi host
What I'm struggling with is to understand why then is the non-persistent storage log alarm going away after vRLI is registered to the hosts?
Because it detects that logs are being off-loaded to *some* place other than residing solely on a host which stores them in RAM. The alarm is just designed to let you know that those logs are ephemeral in nature. Once they're off-loaded to another location, that's no longer true.
So then that means scratch is being sent to Log Insight then and does not need to be updated on the host?
Logs are still being stored locally on scratch (which, in your case, is RAM disk), but they're also being sent to vRLI. If you want them saved to a persistent location on ESXi in addition, you'll need to direct those logs to some other scratch location than a RAM disk. The choice is yours.
Ahh ok, see I thought I had read that before. Since at least one copy is being sent to vRLI then there may or may not be a need to store them locally as well. thanks!