While setting up a Log Insight in your Environment you must have this question on how we can find the perfect sizing for my appliance so that we don’t use unnecessary storage and we don’t get into an issue where the Logs are rolling over.
Generally, you are going to get into these calculations in two different scenarios:
Existing Setup:
Let’s First Discuss an Existing Setup where you are seeing the below issue where your Storage/var is running almost full on your 3 Node Log Insight.
Filesystem | Size | Used | Avail | Use% | Mounted on |
/dev/sda3 | 16G | 2.1G | 13G | 14% | / |
udev | 2.0G | 112K | 2.0G | 1% | /dev |
tmpfs | 2.0G | 648K | 2.0G | 1% | /dev/shm |
/dev/sda1 | 128M | 39M | 83M | 32% | /boot |
/dev/mapper/data-var | 20G | 19.4G | 0.6G | 97% | /storage/var |
/dev/mapper/data-core | 20G | 18G | 1.7G | 92% | /storage/core |
In these scenarios, you just need to understand how you can do the sizing calculation and add the Storage to the Log Insight Appliance.
In this scenario, I will recommend you to use the Log Insight Sizing Calculator to get the Exact Numbers you need.
You can get the Tool from the below Vmware Link: https://kb.vmware.com/s/article/60355
Once you have the sheet, you can open it in Excel and go to the Sizing Tab:
Now to get the Exact Value you will be needing the “Ingestion Per Second” and Retention Time. You can check these details from your existing Log Insight Setup.
Here you can find the Ingestion rate for all the Log Insight Nodes that are running in the Environment :
Here you can find the Retention Period Configured for your Log Insight. In my case, it is 365 Days.
Now you can simply add this information as mentioned below:
- Ingestion per Second 7000 in B14 in the Excel Sheet and Retention Period in E11.
- Once added you should be able to see the Storage Requirement per Node as shown below:
Now you know that to Handle the Data for your environment for 365 Days you will need 15900 GB of Storage on all the Nodes in the Log insight Appliance.
Recommendation:
Now to Increase the Storage on the Log Insight Appliance, you can simply add a New VMDK of the Appropriate size and restart each of the Log Insight Node. Please make sure you make the same change on all the Log Insight Appliance.
For more information, you can refer to: https://docs.vmware.com/en/vRealize-Log-Insight/8.1/com.vmware.log-insight.administration.doc/GUID-DBC8F35E-369A-4D34-A7AA-96A2C67C9BCC.html
