4.2 Clusters
vRealize Log Insight 2.0 introduced the ability to create multi-node application level clusters, providing support for high availability and, by scaling-out, increasing the log message ingestion rates to the scale required by large service provider customers.
When designing a vRealize Log Insight production environment, a minimum of three nodes is required to form an HA cluster. This supports highly available ingestion, the ability to easily scale-out, and the ability to perform maintenance on a live environment. Additionally, vRealize Log Insight clusters provide support for the following:
• A scale-out approach to designs using a centralized logging service.
• Multiple vRealize Log Insight instances working together and managed centrally.
• Log ingestion high availability that can be achieved either through the interpreted load balancer or by placing a third party load balancer in front of the cluster to handle the ingestion of syslog messages, evenly distributing the data across cluster nodes.
• Up to a 12-node cluster with one node as the master and up to eleven other nodes as workers.
• Both master and worker nodes capable of ingesting syslog messages.
• Querying of events from a single dashboard, even if the messages exist on separate nodes.
When designing a service provider management solution, VMware also recommends the use of the integrated load balancer, which allows for distributed ingestion of messages across the cluster nodes and provides high availability for the syslog service. All events are forwarded to the load balancer VIP address, as opposed to the individual vRealize Log Insight nodes. If a vRealize Log Insight node goes down, for example, as a result of host hardware failure, the load balancer will continue to direct events to other nodes within the same cluster. The failed appliance restarts on a different host through the standard vSphere HA mechanism, and there is no service downtime.
If possible, design the vRealize Log Insight cluster to distribute vRealize Log Insight nodes across multiple ESXi hosts in the management cluster to maximize service availability. You can apply a vSphere Distributed Resource Scheduler anti-affinity rule on the group of vRealize Log Insight virtual appliances to increase the availability of the syslog service provided by the cluster. You can also use this rule to specify the relationship between the virtual appliances in the group, so that they remain on separate hosts, thus minimizing the impact caused by a vSphere host restart in a standard vSphere HA environment.
This aligns with the standard VMware recommendation of separating servers and providing redundancy for other critical roles at the application layer to avoid service downtime if a vSphere host fails.
Figure 6. Management Cluster Environment
When evaluating the design factors for vRealize Log Insight clusters, keep in mind the following architectural design points:
• A minimum of three nodes is required in a cluster to provide high availability.
• All nodes must be in the same data center, because vRealize Log Insight does not support geo-clustering.
• All cluster nodes must be in the same Layer 2 network segment if an integrated load balancer is employed.
• Employ either the integrated load balancer or use an external load balancer to load balance traffic across nodes in the cluster.
