converge to VCF 9.1 with 2 instances of aria operations for logs

[Wonsuk Song]

Hello Experts

My customer is running 2 instance of aria operations for logs. One is collecting logs from a VC and esxi hosts and the other is collecting logs from NSX managers for FW related events.

The customer wants to converge the environment for VCF 9.1.

I read VCF 9 "Deploy Log Management" document but I failed to find if I can deploy 2 new log management instance as currently my customer is running.

I need someone help me to find that if the customer can deploy 2 separate log management instances when current vsphere 8 environments are convered for VCF 9.1.

Thank you

[Allan Solomon Mejia]

Hi Wonsuk,

VCF 9.1 is designed to integrate with a single Aria Operations for Logs instance (or clustered deployment) per VCF environment. The deployment workflow does not support provisioning two separate Log Management instances under SDDC Manager.

If your customer currently has two standalone Aria Operations for Logs appliances, they can continue operating both after the VCF conversion, but only the instance integrated with VCF will be lifecycle-managed by SDDC Manager. The second appliance would remain independently managed.

 

VMware's recommended architecture is to consolidate into a single Aria Operations for Logs cluster and ingest logs from vCenter, ESXi, NSX, and other sources into that shared deployment. If operational or security isolation is required, consider using RBAC, log filtering, or forwarding selected logs to an external SIEM rather than maintaining multiple VCF-managed Log Management instances.

I would also ask one follow-up question because it changes the migration approach:

Are the two Aria Operations for Logs instances standalone appliances, or are they already configured as a single cluster with multiple nodes?