Deploying/Activating VCF Log Management in VCF 9.1.0.400+
Since VCF 9.1.0.x, a lot has changed in the platform — and one of the more noticeable shifts is how Log Management works. It is no longer a standalone virtual appliance you deploy and patch on its own. Instead, it now runs as a service inside the VCF Management Services Cluster, the same Kubernetes-based runtime that also hosts Fleet Management and the other core management components.
In this post I’ll walk through how to deploy VCF Log Management in 9.1.0.x, which is relevant for both VCF and VVF customers.
What Changed
In VCF 9.0 and earlier, Log Management (formerly Aria Operations for Logs) was deployed as its own appliance VM or appliance cluster. From 9.1 onward, it is a built-in, containerized core service that runs natively on the VCF Management Services Platform. Deployment, lifecycle management, configuration, access control, and alerting are now all handled centrally through VCF Operations, rather than through a separate product UI.
Prerequisites
- DNS: A DNS-registered FQDN (with both forward and reverse lookup working) reserved for the Log Management instance.
- Capacity in the VCF Services Runtime: Deploying Log Management can trigger an automatic resize of the underlying Kubernetes cluster, so plan for the additional compute ahead of time.
- Sizing decision: The deployment size you choose determines how much compute and storage each node gets. Check the Broadcom ConfigMax portal for current guidance before committing to a size.
- Networking: Deployment currently supports VLAN-backed networks for the VCF Management Services; overlay networking is not yet supported for this component.
Resource Requirements for Log Management Deployments.
| Size | vCPUs per Node | Memory per Node | Storage per Node | Number of Nodes |
|---|---|---|---|---|
| Small | 8 | 16 GB | 575 GB | 1-19 |
| Medium | 24 | 48 GB | 575 GB | 3-19 |
| Large | 32 | 64 GB | 575 GB | 3-19 |
If you are upgrading from VCF 5.x or 9.0, keep in mind there is no in-place upgrade path for Log Management. You need to deploy a fresh Log Management instance in your 9.1 environment, then migrate roughly the last 90 days of data from the old appliance. Once the migration is confirmed, the legacy appliance(s) can be decommissioned.
Procedure
- Log in to the VCF Operations user interface at https://<vcf_operations_fqdn> as a user assigned the Administrator role.
- Navigate to BuildLifecycleVCF Management.
- On the Components tab, select Add componentLog management and configure the parameters for the deployment.
| Option | Description |
|---|---|
| Version | Select the version for the instance. |
| Import configuration from an earlier Operations for logs instance | Select to migrate a VMware Aria Operations for Logs 8.x configuration. You also enter the FQDN, admin username, and password for the instance that you migrate from. |
| Log management FQDN | Enter the new Fully Qualified Domain Name to assign to that instance. The FQDN must be unique and should not point to any IP addresses already assigned to VCF services runtime nodes. If you have a deployment, the FQDN for the new deployment must be different than the existing one. Note: Do not use capital letters in the FQDN, because of the VCF Management Services requirements. |
| Size | Select a deployment size. The deployment size determines the compute and storage resources allocated to each node. For maximum limits and sizing specifics, see VMware Configuration Maximums. |
| Number of Replicas | Specify the number of replicas for the current deployment. The number of replicas is restricted based on the deployment size. |
Now click Next to proceed to the Summary page for final review before deployment. Click Finish to start the deployment. As soon as the Deployment is done, you will see Log Management is running under VCF Operations -> Build -> Lifecycle.
You can find the Logs under VCF Operations -> Operate -> Log.
If you click on Log Sources, you will get an overview of the currently configured integrations, but this does not mean, that the Log collection itself is enabled.
To check the Status of the Log collection go to VCF Operations -> Operate -> Administration -> Configurations -> Log Collection. There you will see under Status that the Log collection is not enabled.
If you click on the “i” under Status you will see:
This is a little bit confiusing in my opinion, but yes, you have to switch back to the Integrations page inside VCF Operations and Edit your VMware Cloud Foundation Account:
From the Account page switch to Domains:
Inside the Domain Page you have several product areas and now the important part, starting with vCenter, activate the Logs Collection by clicking “Activate Log Collection” and SAVE.
Same procedure i.e. NSX:
After activiation of Log collection you will see more Logs inside VCF Operations:
The move to a service-based Log Management model in VCF 9.1 removes a standalone appliance from your environment, but it does add a few new planning considerations — DNS, sizing, and Kubernetes runtime capacity chief among them. Once deployed, though, the day-to-day experience of searching, filtering, and alerting on logs is fully consolidated into VCF Operations, which makes it much easier to manage alongside the rest of your VCF estate.
If you have any questions please use the comment section below. This post is created in combination with following TechDoc: Deploy Log Management
*** Very Important: The Logo of VCF Log Management, which is used, is not a official Logo by VMware by Broadcom, its just a fantasy Logo for this Blog Post build by me. ***