In this part you add VCF Operations for Logs, the integrated log management service for a VCF 9.1 fleet. It is optional, but most environments want it for troubleshooting and audit. You deploy it as a Day-N component from inside VCF Operations, and it runs on the VCF Management Services cluster rather than as a separate appliance you manage by hand.

Confirm the fleet is healthy, reserve the addresses the service needs, add the component, then turn on collection. Collection does not start on its own, which is the step people miss, so the last part of this guide walks through enabling it and checking that logs actually arrive.

Prerequisites

Step 1 confirm the fleet is healthy

Start from a clean, reachable fleet.

1. Log in to the VCF Operations UI as an administrator.
2. Open Fleet Management and confirm overall fleet health shows no critical alerts.
3. Confirm the VCF Management Services cluster shows Running.

Step 2 confirm cluster capacity

Deploying Log Management resizes the Management Services cluster, so it needs room to grow.

1. Confirm the Management Services cluster has compute headroom for a worker node at 12 vCPU and 24 GB RAM.
2. Confirm the Management Services IP ranges have spare addresses for the new node. Add or extend a range under Lifecycle if they are full.
3. Reserve a DNS record, forward and reverse, for the Log Management instance FQDN.

Step 3 add the Log Management component

Add the component from the lifecycle area of VCF Operations.

1. In VCF Operations, open Build.
2. Go to Lifecycle, then VCF Management, then Components.
3. Click Add Component.
4. Choose Log Management.

Step 4 set version, FQDN and size

Fill in the wizard for the new instance.

1. Select the version for the instance.
2. Enter the FQDN you reserved in DNS.
3. Choose a deployment size. Use a small size for labs and small fleets, and a large size for production and high availability.
4. Note the worker node the deployment adds, at 12 vCPU and 24 GB RAM.
5. Select the box to acknowledge the service interruption, then click Next.

Step 5 start the deployment

Review and launch, then let the task run.

1. Review the summary of version, FQDN and size.
2. Click Finish to start the deployment.
3. Click View Details to track the tasks, which take about 30 to 45 minutes, until the component shows Active.

Step 6 start log collection

Deployment alone does not collect logs, so turn collection on.

1. Go to Operate, then Administration, then Integrations, then Accounts, and confirm your infrastructure endpoints are registered. Add any that are missing.
2. Expand VMware Cloud Foundation and locate your VCF instance.
3. Click the three-dot menu on the instance.
4. Select Start Collection.
5. For a single component, open it, click Activate Log Collection, then click Save.

Step 7 verify events arrive

Confirm logs are flowing before you rely on them.

1. Open Operate, then Logs.
2. Run a query for recent events and confirm entries from vCenter, ESX and NSX.
3. Open the Collection Status tab and expand VCF Operations Collector to confirm the endpoint adapters are streaming.

flowchart TD
A[Confirm fleet health] --> B[Confirm cluster capacity]
B --> C[Add Log Management component]
C --> D[Set size and HA]
D --> E[Finish and wait for Active]
E --> F[Start collection per instance]
F --> G[Activate collection per component]
G --> H[Verify events in Logs]

Verify log collection

Confirm the component is Active in Lifecycle, then open Operate, then Logs, and run a query for the last few minutes. You should see events from vCenter, ESX and NSX, and each component you activated should report a collecting state. If you use logs day to day, the day-2 troubleshooting workflow shows how to turn these events into fast answers.

Size log management for your fleet

The first deployment adds a worker node at 12 vCPU and 24 GB RAM to the Management Services cluster, which suits a small fleet. As log volume grows with more workload domains and chattier components, scale out to more replicas for capacity and resilience. Each replica adds another worker node to the Management Services cluster, so it draws compute and an address from the Management Services IP ranges. Only medium and large deployments can scale out from the UI, so pick medium or larger if you expect to grow. Plan retention against the disk the cluster has, because longer retention and higher ingest both consume space. The Management Services platform uses up to 30 addresses across its ranges, so keep spare capacity there rather than carving a separate block for logs.

What log management collects

Once collection is on, log management gathers events from the core VCF components, vCenter, ESX, NSX, vSAN and SDDC Manager, along with VCF Automation, VCF Operations, the Identity Broker and HCX. Collection is per component and per workload domain, so you decide how wide to cast the net. Turn it on for the management domain first, confirm events arrive, then extend it to each workload domain. Keep an eye on which components are chatty, because a noisy source can dominate ingest and shorten retention for everything else.

Add content packs and dashboards

Log management ships with dashboards and alerts for the core VCF components, and you extend that coverage with content packs. A content pack bundles dashboards, extracted fields, saved queries and alerts for a specific product or log source. Browse and import them from the logs interface under Operate, then Logs.

When you import a pack you choose how it lands. Install it as a read only pack that every user sees and cannot change by accident, or extract its dashboards, alerts and queries into your own My Content folder where you can edit them. Content packs are still supported in 9.1, but Broadcom is moving this coverage into management packs, so favor the built in dashboards and management packs for anything new.

Scale and maintain log management

Log management grows in two ways as ingest climbs. To add disk to the existing nodes, open Build, then Lifecycle, then VCF Management, then Log Management, then Actions, then Increase Storage Size. To add capacity and resilience, scale out to more replicas. Only medium and large deployments scale out from the UI, so a small deployment scales through the API only. Neither move reverses, so once you scale to more replicas or a larger size you cannot reduce it later. Pick a size that fits the next year of growth rather than the first week.

For a fleet with several workload domains, deploy a dedicated collector, or cloud proxy, per domain rather than pointing everything at the management domain collector. Local collection keeps log traffic inside each domain and cuts cross domain load. Treat log management as part of the fleet you patch and back up on the same schedule as the rest of the Management Services platform.

There is no in place upgrade from VCF 5.x or 9.0. Deploy a fresh Log Management instance in 9.1, then migrate the last 90 days of data from the old appliance. Once the data has moved and you have confirmed events in the new instance, retire the old appliances.

Notes and best practices

Turn collection on for the management domain first and confirm events arrive before you extend it to every workload domain, because a wide switch on with a misconfigured source floods the index and hides the events you care about. Watch the chatty sources in the first days and tune them, since one noisy component can dominate ingest and shorten retention for everything else. Scale out to more replicas before you hit capacity rather than after, and remember each one adds a worker node that draws from the Management Services cluster, so keep spare compute and addresses in the Management Services ranges. Only medium and large deployments scale out from the UI, so choose medium or larger if you expect the fleet to grow. Review retention against disk every month while the fleet is growing, because ingest climbs quietly as you add domains. Treat log management as part of the fleet you patch and back up, not a bolt-on you set once and forget.

Common errors and fixes

Deployment stalls on IP allocation.
The Management Services IP ranges have no free addresses for the new worker node. Add or extend a range under Lifecycle and retry the component.

No logs after deployment.
Collection is not automatic. Run Start Collection on the instance and Activate Log Collection on each component.

Not enough cluster capacity.
The first deployment adds a 12 vCPU, 24 GB RAM worker node. Confirm the management cluster has headroom before you start.

License does not cover log management.
Apply a VCF subscription that includes it, then retry.

The FQDN does not resolve.
Deployment needs forward and reverse DNS for the instance name. Add both records and confirm they resolve before you retry.

No logs from a component you activated.
Check that the endpoint is registered under Operate, Administration, Integrations, Accounts, then reactivate log collection on it.

Cannot scale out a small deployment.
Only medium and large sizes scale out from the UI. Scale a small deployment through the API, or deploy medium or larger from the start.

Common questions

Is VCF Operations for Logs mandatory
No. It is an optional Day-N component, though most environments deploy it for troubleshooting and audit.

Where does it run
On the VCF Management Services cluster, and you manage it from VCF Operations rather than as a standalone appliance.

How many IP addresses does it need
It draws addresses from the Management Services ranges as the cluster resizes, so there is no separate reservation for logs. Keep spare capacity in those ranges, which hold up to 30 addresses for the whole platform.

Do logs collect automatically after deployment
No. Start collection on the VCF instance and activate it per component.

Where do I view the logs
Open Operate, then Logs, for the classic log interface. Audit records live under Protect, then Audit Records.

Can I scale it back down later
No. Once you scale to more replicas or a larger size, you cannot reduce the replica count or the size profile.

Can I upgrade an earlier appliance in place
No. There is no in place upgrade from VCF 5.x or 9.0. Deploy a fresh instance in 9.1, then migrate the last 90 days of data and retire the old appliance.

References

• Broadcom TechDocs: Simple Log Management Model (VCF 9.1)
• What is new: VCF Operations for Logs in 9.1
• VCF 9.1 Home Lab: Deploy VCF Operations for Logs

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts