Intelligent Logging and Analytics for VMware Cloud Foundation

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-NET-002Allocate statically a

Component: VAOL

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-NET-004Configure forward+reverse DNS for all cluster nodes + ILB VIP.FQDN-based access.Must provide DNS records.

Component: VAOL

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-NET-004Configure forward+reverse DNS for all cluster nodes + ILB VIP.FQDN-based access.Must provide DNS records.

Component: VAOL

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-NET-005Enable Aria Ops for Logs Integrated Load Balancer (ILB).Balances ingestion across nodes, provides HA.Must provide extra IP and FQDN for ILB.

Component: VAOL

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-NET-006Configure NTP on each cluster node.Aria Ops for Logs depends on time sync.None.

Component: VAOL

Decision: Deploy a 3-node (1 primary + 2 workers) Aria Ops for Logs cluster.

Rationale: Provides high availability and 200 syslog connections support.

Implication: Must deploy 3 VMs; ILB VIP FQDN + IP required.

Component: VAOL

Decision: Deploy Aria Ops for Logs via Aria Suite Lifecycle.

Rationale: Standard LCM workflow.

Implication: Must deploy Aria Suite Lifecycle first (via SDDC Manager).

Component: VAOL

Decision: Protect all Aria Ops for Logs VMs with vSphere HA.

Rationale: Supports availability objective.

Implication: None.

Component: VAOL

Decision: Apply vSphere Distributed Resource Scheduler anti-affinity to cluster nodes.

Rationale: Ensure nodes run on separate hosts for fault tolerance.

Implication: Must configure DRS rules.

Component: VAOL

Decision: Place Aria Ops for Logs VMs in designated VM folder.

Rationale: Inventory organization.

Implication: Must create folder.

Component: VAOL

Decision: With 2 AZs, bind Aria Ops for Logs cluster to first AZ hosts group.

Rationale: Cluster runs in first AZ; fails over to second AZ on AZ failure.

Implication: VM group update after second AZ deployed.

Component: VAOL

Decision: In multi-VCF, deploy a separate Aria Ops for Logs cluster per VCF instance.

Rationale: Provides local Aria Ops for Logs per instance.

Implication: Must deploy Aria Ops for Logs per VCF instance.

Component: VAOL

Decision: IDILA-VAOL-CFG-009

Rationale: See source document for rationale

Implication: No significant trade-offs identified for this decision.

Component: VAOL

Decision: Deploy each node sized Medium.

Rationale: See source document for rationale

Implication: Must scale up for additional load.

Component: VAOL

Decision: Activate integration with identity source via AD over LDAP.

Rationale: Authentication via identity source; role-based authorization for enterprise users/groups.

Implication: None.

Component: VAOL

Decision: Create security group in directory services for admins; assign Super Admin role.

Rationale: Streamlines role mgmt; managed admin access; accountability.

Implication: Create and maintain AD group outside SDDC stack.

Component: VAOL

Decision: Create security group for users; assign User role.Streamlines role mgmt.Create and maintain AD group.

Rationale: ILA-VAOL-SEC-004Create security group for viewers; assign View Only Admin role.Streamlines role mgmt.Create and maintain AD group.

Implication: Password Management

Component: VAOL

Decision: Configure password expiration policy for each Aria Ops for Logs appliance.

Rationale: Compliance alignment.

Implication: Manage via appliance console or SSH.

Component: VAOL

Decision: Configure password complexity policy.

Rationale: Compliance alignment.

Implication: Manage via appliance console or SSH.

Component: VAOL

Decision: Configure account lockout policy.

Rationale: Compliance alignment.

Implication: Manage via appliance console or SSH.

Component: VAOL

Decision: Change the root password on recurring schedule via SDDC Manager UI/API.Default password expires every 365 days; root managed from SDDC Manager UI/API (NOT Aria Suite Lifecycle) when deployed in VCF vi

Rationale: ILA-VAOL-SEC-009Change admin account password on recurring schedule via SDDC Manager UI/API.Admin password managed from SDDC Manager UI/API, NOT Aria Suite Lifecycle.Routine password change via SDDC M

Implication: Certificate Management

Component: VAOL

Decision: Configure retention for medium appliance = 7 days default.

Rationale: Balances storage capacity and forensic availability.

Implication: Adjust per compliance needs.

Component: VAOL

Decision: Configure archive policy = 90 days.

Rationale: Longer-term audit requirements.

Implication: Requires 400 GB shared NFS storage.

Component: VAOL

Decision: Configure 400 GB NFS shared storage for log archival.Supports 90-day archive.NFS mount must have enough free space; enforce archive policy directly on shared storage; in multi-AZ, NFS share available

Rationale: Alert Notifications Design

Implication: Alert Types

Component: VAOL

Decision: Configure alert notifications.

Rationale: See source document for rationale

Implication: Must configure SMTP for email notifications.

Component: VAOL

Decision: Use VMware Aria Suite Lifecycle to perform LCM of Aria Ops for Logs in each VCF instance.

Rationale: See source document for rationale

Implication: Suite Lifecycle must be deployed via SDDC Manager; handles patches/updates/hotfixes.

Component: VAOL

Decision: Install Linux-Systemd, VMware-NSX, VMware-Aria-Suite-Lifecycle-8.12+, VMware Workspace ONE Access content packs.

Rationale: Granular monitoring; W1A content pack requires manual install.

Implication: Manual install of the Workspace ONE Access content pack is required; the remaining content packs are installed from the in-product marketplace.

Component: VAOL

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-CFG-016Connect VCF VI workload domains to Aria Ops for Logs via SDDC Manager.SDDC Manager auto-adds VI workload domain vCenter + ESXi hosts to Aria Ops for Logs.Non

Component: VAOL

Decision: Connect VCF VI workload domains to Aria Ops for Logs via SDDC Manager.

Rationale: SDDC Manager auto-adds VI workload domain vCenter + ESXi hosts to Aria Ops for Logs.

Implication: None.

Component: VAOL

Decision: Install and configure Aria Ops for Logs agent on clustered Workspace ONE Access nodes.

Rationale: Standardized agent config per W1A node for log collection.

Implication: None.

Component: VAOL

Decision: Configure the W1A agent group.

Rationale: Parse W1A-specific logs per file/format.

Implication: None.

Component: VAOL

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-CFG-026In multi-VCF, forward logs to other instance(s) vi

Component: VAOL

Decision: JustificationImplication

Rationale: See source document for rationale

Implication: ILA-VAOL-CFG-026In multi-VCF, forward logs to other instance(s) via Ingestion API (TCP).Supports structured/unstructured data with client-side compression; log throttl

Component: VAOL

Decision: In multi-VCF, forward logs to other instance(s) via Ingestion API (TCP).

Rationale: Supports structured/unstructured data with client-side compression; log throttling across clusters; preserves cross-instance log.

Implication: Requires firewall rules and network reachability between instances on the Ingestion API (TCP) port, and forwarded volume must be sized into the receiving cluster.

Component: VAOL

Decision: Configure log forwarding to use SSL on port 9543.

Rationale: Secure log forwarding.

Implication: Must set up a custom CA-signed SSL certificate; event forwarding with SSL does not work with the self-signed certificate.

Component: VAOL