vRealize Log Insight internal storage management
Recently I encountered a alert in vRealize Operations stating that on one of my virtual machines the disks-ace was getting low. It turned out to be the vRealize Log Insight server in my test environment. For those of you that don’t know, vRealize Log Insight is a highly scalable log management solution which can collect all log information in your environment and analyse and present this in intuitive, actionable dashboards and sophisticated analytics.
Browsing through the vRealize Log Insight interface I could not find any settings regarding retention times, garbage collection intervals, history settings or any techniques to limit the amount of disk space which is used. The only option I have is to setup an Archive location which ensures long time archival of log data.
So how does vRealize Log Insight manage its internal storage capacity, how to free up disk space, how to extend disk space?
vRealize Log Insight Internal storage management
After the initial installation vRealize Log Insight has the following disk layout.
- Root file system: 12 GB.
- Log Data volume (size depends on deployment):
- Extra-Small/Small deployment: 120 GB
- Medium/Large: 270 GB
- First boot volume: 256 MB.
I deployed an Extra-Small deployment so I have a 120 GB volume on which the system stores the collected log information. (An observant viewer may have noticed that the vRealize Log Insight System Monitor only reports 93.4 GB of available space. The additional space is reserved for system purposes so that the system can continue to function even if all the space available has filled up.)
Why is the storage space 97% utilized?
vRealize Log Insight stores the collected log data in buckets which are stored locally. New log data will be added to the bucket until the bucket reaches 1 GB. When that happens a new bucket is created and the old bucket will be marked read-only.
The system uses all storage that is presented to it to store these buckets and maintains the space itself. The Log Data volume is designed to fill up to a maximum of 97%.
In normal situations, the system never runs out of disk because every minute it checks if the free space is less than 3%. If the free space on the vRealize Log Insight virtual appliance drops below 3%, old data buckets are retired. However, if the disk is small and log ingestion rate is so high that the free space (3%) is filled out within 1 minute, vRealize Log Insight runs out of disk space. If archiving is enabled, vRealize Log Insight archives the bucket before retiring it. If the free space is filled before the old bucket is archived and retired, the system runs out of disk.
In short, the vRealize Log Insight internal storage management:
- may fill up the Log Data Volume to a maximum of 97% (under normal operating conditions).
- will not remove stored events until the maximum capacity (97%) is reached. This means Log Insight will keep all the events as long as it has space for it. So environments with a low log volume may hold years of history, environments with a high log volume may just hold months or even weeks of history.
- will only report if the amount of data the system can hold at the current ingestion rate is less than the value configured in the Retention Notification Threshold (Administration/Configuration/General). It will not retire data buckets older than the configured threshold.
- will automatically retire the oldest stored events when retention has been exceeded.
How to increase vRealize Log Insight storage space
According to the vRealize Log Insight Configuration Limits, Log Insight 3.0, 3.3 and 3.6 have a maximum of 4TB addressable storage space, on VMDKs with a maximum size of 2TB each. That means you could have two 2TB VMDKs, or four 1TB VMDKs, etc. Once you get to sizes around that point, though, you’ll probably want to scale outward with a larger cluster size instead of adding more disk to existing VMs.
- Log in to the vSphere Web Client as a user who has privileges to modify the hardware of virtual machines in the environment.
- Shut down the vRealize Log Insight virtual appliance safely.
- In the vSphere Client inventory, right-click the vRealize Log Insight virtual appliance and select [Edit Settings].
- On the Hardware tab, click [Add].
- Select [Hard Disk] and click [Next].
- Select [Create a new virtual disk] and click [Next].
- Type the disk capacity.vRealize Log Insight supports virtual hard disks of up to 2 TB. If you need more capacity, add more than one virtual hard disk.
- Select a disk format.
- Thick Provision Lazy Zeroed.
- Thick Provision Eager Zeroed.
- Thin Provision.
- Select a datastore, browse for the datastore location and click [Next].
- Accept the default virtual device node and click [Next].
- Review the information and click [Finish].
- Click [OK] to save your changes and close the dialog box.
When you power on the vRealize Log Insight virtual appliance, the virtual machine discovers the new virtual disk and automatically adds it to the Log Data volume.
Other articles in the series vRealize Log Insight:
- Getting started with vRealize Log Insight
- vRealize Log Insight quick interface Walkthrough
- Configuring Log Insight for vSphere Integration
- Installing the Windows agent for Log Insight
- vRealize Operations Manager Content Pack for Log Insight
- Installing the Linux agent for Log Insight
- Upgrade to vRealize Log Insight 3.3
- vRealize Log Insight internal storage management
- vRealize Log Insight: Internal vs External Load Balancer
- Control NSX using Log Insight webhooks and a Lego Mindstorms robot
- Integrating VMware NSX with VMware vRealize Log Insight
- vRealize Log Insight 2.5 available soon
- How to provide NSX firewall logging to individual tenants
- Upgrade vRealize Suite using vRealize Lifecycle Manager by Erik Scholten
- Gain insight in Kubernetes by Dimitri De Swart
- Unable to backup iSCSI volume with Veeam Agent for Windows by Edwin Weijdema
- vRealize Operations 6.x certificate expires soon by Erik Scholten
- Accelerating Application Security with Network… by Martijn Smit