In this part you add VCF Operations for Logs, the integrated log management service for a VCF 9.1 fleet. It is optional, but most environments want it for troubleshooting and audit. You deploy it as a Day-N component from inside VCF Operations, and it runs on the VCF Management Services cluster rather than as a separate appliance you manage by hand.

Confirm the fleet is healthy, reserve the addresses the service needs, add the component, then turn on collection. Collection does not start on its own, which is the step people miss, so the last part of this guide walks through enabling it and checking that logs actually arrive.

Prerequisites

Step 1 confirm the fleet is healthy

Start from a clean, reachable fleet.

1. Log in to the VCF Operations UI as an administrator.
2. Open Fleet Management and confirm overall fleet health shows no critical alerts.
3. Confirm the VCF Management Services cluster shows Running.

Step 2 reserve IP capacity

Log management draws addresses from the Management Services range.

1. Confirm at least 6 free IPs in the Management Services range.
2. Add 2 IPs for every extra replica you plan to run for high availability.
3. Keep all of them inside the reserved /27 Management Services block.

Step 3 add the Log Management component

Add the component from the lifecycle area of VCF Operations.

1. In VCF Operations, open Lifecycle.
2. Click VCF Management.
3. Click Add Component.
4. Choose Log Management.
5. Click Next.

Step 4 set size and high availability

Pick a size that matches your fleet and decide on replicas.

1. Select the deployment size for your environment.
2. Enable high availability if you need it, remembering each replica adds 2 IPs.
3. Note the worker node the wizard will add, at 12 vCPU and 24 GB RAM.
4. Click Next.

Step 5 start the deployment

Review and launch, then let the task run.

1. Review the summary of nodes, sizing and addresses.
2. Click Finish to start the deployment.
3. Watch the task in Lifecycle until the component shows Active.

Step 6 start log collection

Deployment alone does not collect logs, so turn collection on.

1. In VCF Operations, expand VMware Cloud Foundation and locate your VCF instance.
2. Click the three-dot menu on the instance.
3. Select Start Collection.
4. For a single component, open it and click Activate Log Collection.
5. Click Save.

Step 7 verify events arrive

Confirm logs are flowing before you rely on them.

1. Open VCF Operations for Logs.
2. Run a query for recent events and confirm entries from vCenter, ESX and NSX.
3. Confirm each activated component shows a collecting state.

flowchart TD
A[Confirm fleet health] --> B[Reserve 6 or more IPs]
B --> C[Add Log Management component]
C --> D[Set size and HA]
D --> E[Finish and wait for Active]
E --> F[Start collection per instance]
F --> G[Activate collection per component]
G --> H[Verify events in Logs]

Verify log collection

Confirm the component is Active in Lifecycle, then open VCF Operations for Logs and run a query for the last few minutes. You should see events from vCenter, ESX and NSX, and each component you activated should report a collecting state. If you use logs day to day, the day-2 troubleshooting workflow shows how to turn these events into fast answers.

Size log management for your fleet

The first deployment adds a worker node at 12 vCPU and 24 GB RAM to the Management Services cluster, which suits a small fleet. As log volume grows with more workload domains and chattier components, add replicas for capacity and resilience, and remember each replica takes 2 more addresses from the Management Services range. Plan retention against the disk the cluster has, because longer retention and higher ingest both consume space. If you run several VCF instances, size the range at the recommended 30 addresses from the start so logs and real-time metrics both fit without re-carving the block later.

What log management collects

Once collection is on, log management gathers events from the core VCF components, vCenter, ESX, NSX and SDDC Manager, along with the VCF services themselves. Collection is per component and per workload domain, so you decide how wide to cast the net. Turn it on for the management domain first, confirm events arrive, then extend it to each workload domain. Keep an eye on which components are chatty, because a noisy source can dominate ingest and shorten retention for everything else.

Notes and best practices

Turn collection on for the management domain first and confirm events arrive before you extend it to every workload domain, because a wide switch on with a misconfigured source floods the index and hides the events you care about. Watch the chatty sources in the first days and tune them, since one noisy component can dominate ingest and shorten retention for everything else. Add replicas before you hit capacity rather than after, and remember each one costs 2 addresses from the Management Services range, so keep that range at the recommended 30 so log management and real-time metrics both fit. Review retention against disk every month while the fleet is growing, because ingest climbs quietly as you add domains. Treat log management as part of the fleet you patch and back up, not a bolt-on you set once and forget.

Common errors and fixes

Deployment stalls on IP allocation.
The Management Services range has no free addresses. Free up at least 6 in the /27 and retry the component.

No logs after deployment.
Collection is not automatic. Run Start Collection on the instance and Activate Log Collection on each component.

Not enough cluster capacity.
The first deployment adds a 12 vCPU, 24 GB RAM worker node. Confirm the management cluster has headroom before you start.

License does not cover log management.
Apply a VCF subscription that includes it, then retry.

Common questions

Is VCF Operations for Logs mandatory
No. It is an optional Day-N component, though most environments deploy it for troubleshooting and audit.

Where does it run
On the VCF Management Services cluster, and you manage it from VCF Operations rather than as a standalone appliance.

How many IP addresses does it need
Six in the Management Services range, plus two for each additional replica.

Do logs collect automatically after deployment
No. Start collection on the VCF instance and activate it per component.

References

• Broadcom TechDocs: Simple Log Management Model (VCF 9.1)
• What is new: VCF Operations for Logs in 9.1
• VCF 9.1 Home Lab: Deploy VCF Operations for Logs

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts