I have received some questions in regards to the virtual disk size on the Log Insight virtual appliance that I wanted to address. If you have any other questions, let me know!
How do I increase the size of the virtual disk?
Simply power down the VA, add one or more virtual disks, and power on the VM. That’s it! Log Insight does the rest for you during power on (e.g. it extends the LVM).
Important: Do not add space to an existing virtual disk as this will not work.
How do I decrease the size of the virtual disk?
Decreasing the size of the virtual disk is not supported and doing so may result in data corruption or loss.
How can I clean up / free up space on the virtual disk?
Log Insight automatically cleans up the virtual disk. No changes should be made to the OS of the virtual appliance. Deleting anything from the OS may result in permanent data loss or corruption.
How should Log Insight be provisioned (thin, thick, etc) during deployment?
All provision options are supported. The recommendation is to use a thick provisioning option for production workloads because in production environments it is normal behavior for the virtual disk to be close to full capacity at all times.
To clarify this point, Log Insight uses local disk space for the retention of log messages. When local space is close to full, Log Insight deletes data in a FIFO manner. Log Insight attempts to keep data locally for as long as possible so the data can be queried against. How long log messages can be stored for depends on a variety factors including events per second and size of events.
In case you are wondering about the performance of the different provisioning options see:
© 2014, Steve Flanders. All rights reserved.
Steve, presumably to increase capacity for Log Insight you need to make identical additions of disks to each node? Does it make any odds what order you cycle through the nodes to make this change?
Thanks
Hey Mark — Thanks for the comment. Correct on same amount of disk space per node. No, it does not matter the order in which space is added though I would do they all the same day.
Many thanks Steve