Log Insight: Server vs. Forwarder

Based on some recent Log Insight conversations, I realized there is some confusion around what the difference is between a Log Insight server and a Log Insight forwarder. In this post, I would like to clear up the confusion.

Log Insight Server

First, let’s start with the easy part — what is a Log Insight server? A Log Insight server is the OVA that VMware ships providing you a management product that can be used to ingest data as well as query data. The server is the central part of Log Insight and what was originally released with Log Insight 1.0. Since the release of Log Insight 1.0 two other “components” have been released in addition to the server: Log Insight agents (both Windows and Linux) and Event Forwarding (Log Insight forwarder).

Log Insight Forwarder

In Log Insight 2.5 Event Forwarding was introduced. This feature made it possible to forward events ingested by a Log Insight server to another logging product — either via the ingestion API if the remote destination was another Log Insight server or via syslog for other remote destinations. This means that a Log Insight server — starting with Log Insight 2.5 — is also a “forwarder” or at least contains the capability to serve as a forwarder.

Log Forwarder

So what is a (log) forwarder? Just like it sounds, a forwarder provides the ability to forward logs to a remote destination. Now you might be wondering why you would need a (log) forwarder. Here are a few reasons:

• To aggregate logs within a protected network (e.g. DMZ)
• To reduce the end-points sending logs to a remote destination (e.g. WAN and/or firewall rules)
• To provide metadata (e.g. which DC the event came from)

I actually have a post on 12 Reasons Why You Should Use A Log Insight Forwarder, which I would encourage you to take a look at.

Log Insight Instance

I am about to use another term: “Log Insight Instance” that I would like to define. When I say Log Insight instance, I am referring to a Log Insight server — either standalone or cluster. I use the term instance because it is a centrally controlled and managed Log Insight configuration. You will see why this distinction matters next.

Server vs. Forwarder

OK, now you know what a Log Insight server is, when the Event Forwarding feature was introduced and that it is part of every Log Insight server, and the reasons to or benefits of using forwarding. Now for the critical question: what is the difference between a Log Insight server and a Log Insight forwarder?
A server can be, but does not need to be, a forwarder. A forwarder is always a server. When you hear the term “Log Insight forwarder” you should think a completely different Log Insight instance. The best way to think of it is that a Log Insight forwarder is a log aggregator, but is not the central location of all logs within an environment. It is common to deploy a Log Insight forwarder at every datacenter which forwards its logs to a central Log Insight instance in a single datacenter or two different datacenters for when DR is required.
Now you might be wondering what if I have a central Log Insight instance that also forwards? As a specific example, let’s say Log Insight is the central log aggregator in my environment, but the security team has a different SIEM tool they use for log analysis today and cannot switch. In this case, the Log Insight instance is a server, which also forwards a subset of events to a remote destination — it would not be a Log Insight forwarder as forwarding is not its primary responsibility.
So to be crystal clear, when you hear “Log Insight Forwarder” you so think of a dedicated Log Insight instance whose primary job is to forward events to a remote destination. A Log Insight forwarder should not normally be used for query.

Unsupported

The reason for this post is to clear up the difference between a Log Insight server and a Log Insight forwarder and also to ensure you do not end up with an unsupported configuration. Note that a geo-cluster — a single Log Insight cluster with nodes in different datacenters — is not supported. So if you have say three datacenters and you wish to put forwarders in two you would not build a 3-node cluster in the primary datacenter — a master and two worker nodes — and then deploy and add two additional workers nodes — one in each datacenter — to deploy forwarders. Instead, you would have a 3-node cluster in your primary datacenter and you would deploy two standalone and completely separate Log Insight server instances in the two other datacenters and configure them to forward to the primary datacenter. The net result will be three Log Insight instances which are managed completely separately.

Summary

The important bullet points in this post are:

• A Log Insight instance is a centrally managed Log Insight standalone or clustered server.
• A Log Insight server is a Log Insight instance whose responsibility is to ingest logs and provide a query interface.
• A Log Insight forwarder is a Log Insight instance whose responsibility is to ingest logs and forward them to a remote destination — normally queries would not take place on a forwarder.
• A Log Insight server provides event forwarding capabilities starting with Log Insight 2.5.
• A Log Insight geo-cluster is not supported.
• Log Insight forwarders should be deployed as separate Log Insight instances and not workers to an existing Log Insight instance.

I hope this clears up the difference!

© 2015, Steve Flanders. All rights reserved.