By default, the Log Insight virtual appliance has 2 vCPUs, 4GB of virtual memory, and 144GB of disk space provisioned. Log Insight uses 100GB of the disk space to store raw data, index, metadata, and so on.

You can change the settings according to the environment for which you intend to collect logs.

During the virtual appliance deployment, you can select the size of the appliance as follows.

Option

Log Ingest Rate

vCPUs

Memory

IOPS

Syslog Connections

Events per Second

Extra Small

3GB/day

2

4GB

75

20

200

Small

15GB/day

4

8GB

500

100

1000

Medium

37.5GB/day

8

16GB

1000

250

2500

Large

112.5GB/day

16

32GB

1500

750

7500

Note

You can use a syslog aggregator to increase the number of syslog connections that send events to Log Insight. However, the maximum number of events per second is fixed and does not depend on the use of a syslog aggregator. A Log Insight instance cannot be used as a syslog aggregator.

The sizing is based on the following assumptions.

Each vCPU is at least 2GHz.

Each ESXi host sends up to 10 messages per second with an average message size of 170 bytes/message. This is roughly equivalent to 150MB/day/host.

Note

For large installations, you must upgrade the virtual hardware version of the Log Insight virtual machine. Log Insight supports virtual hardware version 7 or later. Virtual hardware version 7 can support up to 8 vCPUs. Therefore, you must upgrade to virtual hardware version 8 or later for ESXi 5.x if you plan to provision 16 vCPUs. You use the vSphere Client to upgrade the virtual hardware. If you want to upgrade virtual hardware to the latest version, read and understand the information in the VMware knowledge base article Upgrading a virtual machine to the latest hardware version (1010675) .

Use a large configuration for the master and worker nodes in a Log Insight cluster. The number of events per second increases linearly with the number of nodes.

If you want to use the Extra Small version of the appliance on your laptop, but the laptop does not have enough memory, you can reduce the memory size to 2GB.