converge to VCF 9.1 with 2 instances of aria operations for logs

[Wonsuk Song]

Hello Experts

My customer is running 2 instance of aria operations for logs. One is collecting logs from a VC and esxi hosts and the other is collecting logs from NSX managers for FW related events.

The customer wants to converge the environment for VCF 9.1.

I read VCF 9 "Deploy Log Management" document but I failed to find if I can deploy 2 new log management instance as currently my customer is running.

I need someone help me to find that if the customer can deploy 2 separate log management instances when current vsphere 8 environments are convered for VCF 9.1.

Thank you

[Allan Solomon Mejia]

Hi Wonsuk,

 

With VCF 9.1, Log Management is architecturally different from the standalone Aria Operations for Logs deployments you're using today.

 

In 9.1, Log Management is a built-in, containerized service running on the VCF Management Services Platform and is managed centrally through VCF Operations. It is no longer treated as a traditional standalone Aria Operations for Logs appliance/cluster. Broadcom confirms that deployment, lifecycle, configuration, and access are consolidated into VCF Operations.

 

Because of this, I wouldn't try to reproduce the existing design as two independent Log Management environments simply because there are currently two Aria Operations for Logs instances.

 

Instead, I would plan the VCF 9.1 architecture around the integrated Log Management service and configure log collection for the appropriate vCenter, ESX, and NSX components there.

 

There is also an important VCF 9.1 limitation to consider: Broadcom states that log collection should be managed by only one VCF Operations instance per component. For vCenter 9.1 and NSX 9.1 specifically, enabling collection can overwrite the component's existing log-collection configuration.

 

So for your scenario, I would recommend:

 

1. Deploy the VCF 9.1 Log Management service as part of the VCF Management Services architecture.
2. Configure collection from the required vCenter/ESX and NSX environments.
3. Preserve the logical separation you need for NSX firewall events using Log Management configuration, queries, processing rules, access controls, etc., rather than assuming that two separate Log Management deployments are required.
4. If there is a hard requirement for two completely isolated Log Management instances, I would validate that topology with Broadcom before proceeding, because I haven't found documentation confirming that two independent 9.1 Log Management deployments within the same VCF management environment are a supported replacement for two existing Aria Operations for Logs instances.

 

Also keep capacity in mind. Log Management instances are hosted by the VCF Management Services cluster, and VCF automatically manages placement and scaling of those service instances.

 

In short, I would not design the convergence as a 1:1 migration of the two existing Aria Operations for Logs instances. VCF 9.1 changes the logging architecture, so I would first determine whether the current separation is required for security/compliance or was simply an architectural choice in the existing environment.

 

Hope this helps.