Logs Deployment & Use

Phase: Post-Deployment (Day 2+)

This guide covers deploying VCF Operations for Logs (log analytics) and configuring core VCF components to forward logs into it.

2. Prerequisites

• Working DNS forward/reverse for log.pgnet.io.
• NTP is stable across the environment (time drift causes auth + TLS failures).
• VCF identity and certificates are in place (recommended): see Part 4.
• Depot has 9.0.2 operations-logs install binaries

Network ports (minimum)

• 443/tcp to access the Logs UI/API
• Syslog ingestion (choose one):
  • 514/udp (easy, but lossy)
  • 514/tcp (recommended for lab reliability)
  • 6514/tcp (syslog over TLS, if you enable/configure it)

3. Deploy VCF Operations for Logs

Deploy the Logs appliance from SDDC Manager (the exact menu label varies slightly by release, but it is under the VCF/Operations lifecycle area).

1. Make sure Fleet Management has downloaded intall binaries for 9.0.2 - Operations —> Fleet Management —> Lifecycle —> Binary Management

   

3. From Lifecycle —> Overview Add operations-logs

4. New Install

   

5. Generate a new certificate for the deployment - a wildcard works *.pgnet.io

   

6. Deploying logs appliance on second cluster.

   Config:

   Field	Value
   vCenter Host	vcw.pgnet.io
   vCenter Version	9.0.2.0.25148086
   VC Username	svc-sddc@pgnet.local
   Datacenter / Cluster	DEFAULT_DC / pgdc2#pgdc2cl1
   Storage (Datastore)	pgVMFS
   Network (Portgroup)	pg-dsw-pg-vmmgmt
   Disk Mode	thin

   Setting	Value
   Gateway	10.200.1.1
   Netmask	255.255.255.0
   DNS / NTP	10.200.1.240
   Domain / Search Path	pgnet.io
   FIPS Mode	Enabled (true)
   VCF Enabled	true

   Component	Hostname	IP Address	Details
   Master Node	logvm.pgnet.io	10.200.1.25	VM Name: pg-vm-vcflog
   Cluster VIP	log.pgnet.io	10.200.1.19	Type: vrli-cluster-1
   Node Size	small	—	Version: 9.0.2.0
   Admin Email	admin@pgnet.io	—	SSO Enabled: false

7. Setup the Network

Post-deploy access check

• Open https://log.pgnet.io and confirm the UI loads.
• Confirm you can authenticate with the local/admin account created during deployment.

4. Identity / SSO (recommended)

If you’re using the VCF embedded Identity Broker for the Operations suite, enable SSO for Logs the same way you did for Operations/Automation.

• Follow the identity broker setup in Part 4.
• In the VCF Operations suite SSO settings, ensure VCF Operations for Logs is enabled for the same SSO domain.

5. Forward logs into VCF Operations for Logs

Start by onboarding the highest-signal sources first: vCenter, NSX, SDDC Manager, and ESXi.

5.1 vCenter Server Appliance (VCSA)

Configure VCSA remote syslog forwarding to log.pgnet.io.

• In the VCSA management UI (https://vc.pgnet.io:5480) configure Syslog to forward to the Logs appliance.
• Example destination (TCP syslog): tcp://log.pgnet.io:514

5.2 ESXi hosts

Configure each host to forward syslog to log.pgnet.io.

• In vCenter: host → Configure → System → Advanced System Settings
• Set Syslog.global.logHost to the Logs destination.
• Example value (TCP syslog): tcp://log.pgnet.io:514

5.3 NSX Manager

Configure NSX to forward syslog events to log.pgnet.io.

• In NSX Manager: configure a Syslog server and point it at the Logs appliance.
• Prefer TCP (or TLS) over UDP for NSX audit + system events.

5.4 SDDC Manager

Configure SDDC Manager to forward logs/events to log.pgnet.io where supported.

6. Using Logs (minimum workflow)

1. Open https://log.pgnet.io.
2. Confirm ingestion by searching for a known hostname (examples): vc.pgnet.io, nsx.pgnet.io, sddc.pgnet.io, pgesxa1.pgnet.io.
3. Create a saved query for common triage:
   • auth failures (SSO/LDAPS)
   • certificate/TLS errors
   • NSX edge/BGP events

Quick verification checklist

• In the Logs UI, confirm you see events from vc.pgnet.io within a few minutes of enabling forwarding.
• If ESXi forwarding is enabled, search for pgesxa1.pgnet.io and validate new events arrive as you generate activity (e.g., login/logout).
• If nothing arrives, validate the source can reach log.pgnet.io on the chosen syslog port.

7. Quick troubleshooting

• No logs arriving: confirm network reachability from sources to log.pgnet.io and verify each component’s syslog setting.
• TLS/cert errors: ensure time sync is correct and that the relevant trust chain is installed.
• SSO problems: validate the identity broker config in Part 4 and confirm group mappings.