When deploying Log Insight, you have the option of selecting various deployment sizes. By default, Log Insight defaults to small. The best practice for production workloads is to deploy at least medium and, whenever possible large. You will notice that by default and even with the larger deployment sizes, Log Insight allocates just over 500GB of space. In general, 500GB is not a lot of space for events, and for production environments, you will often need more space. With that said, some environments are small and do not require this amount of space/retention. One question I am asked is how to deploy Log Insight with less than 500GB of space. Read on to learn more!
Deploying with less storage
One option you have is to thin provision Log Insight when you deploy it. The problem with this approach is that Log Insight will only purge old data when 97% of the data virtual disk is full. This means the disk may start small, but it will grow over time to consume the entire 500GB.
The best way to deploy Log Insight with less than 500GB of space is to start with the extra small deployment size but then manually increase the CPU/memory to either the small (4/8), medium (8/16), or large (16/32) deployment sizes. The extra small deployment size only consumes about 100GB of storage, however, it is meant for laptop deployments, and I would not recommend using 2/4 even as a trial.
Is it supported?
The obvious question is can you deploy an extra small Log Insight and manually increase the CPU/memory while still being in a supported configuration? The answer is yes. Log Insight dynamically configured itself on start based on the resources available during boot. This means you can manually move from medium to large or even extra small to large. The only difference is that an extra small deployment gives you a smaller initial disk to storage events (100GB vs. 500GB). Of course, you can add one or more additional virtual disks to increase the retention period if desired.
What other options exist?
I really recommend you use the approach above. If you need an even smaller disk footprint, then you enter unsupported territory. With that said, here are a couple of options:
WARNING: This is completely unsupported and may result in Log Insight issues including data loss. You have been warned.
- Reconfigure Log Insight BEFORE first boot — When deploying a new Log Insight instance, before you power it on for the first time, delete the second virtual disk (the largest one) and add a new virtual disk that is 30GB or larger than power on Log Insight. Initially, the second virtual disk does not contain any data, so it is possible to replace it before the first boot.
- Edit the reserved-space-percentage in /usr/lib/loginsight/application/etc/loginsight-config-base.xml — this will change the high water mark from 97% (default) to whatever you set it to. Restart Log Insight after making this change. Note, any change to this setting will be lost upon upgrade.
© 2017 – 2021, Steve Flanders. All rights reserved.
