Tag: Agent

I was recently asked about the Log Insight Agent buffer by a client who wasn’t sure what it was, how it works and how to configure it.

The buffer is used to locally store events and vRLI Agent logs when the vRLI cluster is unreachable.

By default it is set to a maximum of 200MB. When the specified max_disk_buffer is reached, the agent begins to drop new incoming events.

The buffer size is defined in the agent configuration file either locally on each agent by altering the liagent.ini file or centrally using an agent group on the vRLI Administration UI.

Insert the following above the system log definition section to set the buffer to 2GB

[storage] 
max_disk_buffer=2000 

Prior to Agent 4.6 the maximum level was 2000 MB

From Agent 4.6 the maximum has been increased from 2GB to 8GB

Since vRealize Log Insight 4.5 the agent has recursive directory support, however there is a requirement for them to be at least 2 levels deep

If you attempt to configure a log directory less than 2 levels deep using a wildcard it will be accepted on the Log Insight Agent config UI however on the end point you will receive the following error within the LIAgent log directory. (C:\ProgramData\VMware\Log Insight Agent\Logs)

2019-02-07 11:01:59.592025 0x000026e4 <error> FLogCollectorEx:452| Failed to initialize channel [filelog|com.microsoft.iis.IISWildcard] because of improper configuration. DirectoryMonitorEx::CheckBasePathEligible(): The base path should be at least 2 level(s) deep: [D:\Logfiles].

Unfortunately at this time there is no work around.