Move logs from an old vRealize Log Insight (vRLI) Node to a new vRLI Node (Aria Operations for Logs)

  • Log into the old node as root via SSH or Console.
  • Stop the loginsight service on the old Master node:
  • service loginsight stop
  • Move the logs from the old node node to the new node:

scp -r /storage/core/loginsight/cidata/store newnode:/storage/core/loginsight/cidata

scp -r /storage/core/loginsight/cidata/store/*-*-*-*-* newnode:/storage/core/loginsight/cidata

Note: Replace newnode with the IP address or FQDN of the new vRealize Log Insight node.

  • Log into the new node as root via SSH or Console.
  • On the new node, ensure the loginsight service is stopped:

service loginsight stop

  • On the new node, import the logs:

for bucket in $(ls /storage/core/loginsight/cidata/store | grep -v ‘generation\|buckets\|strata_write.lock’); do echo y | /usr/lib/loginsight/application/sbin/bucket-index add $bucket –statuses archived; done

Notes:

The Log Insight service MUST be stopped before running bucket-index.

The buckets will be market as archived immediately, or you can remove the parameter –statuses archived.

To check all buckets have been added correctly: /usr/lib/loginsight/application/sbin/bucket-index show

On the new node, start the loginsight service: