I was recently asked about the Log Insight Agent buffer by a client who wasn’t sure what it was, how it works and how to configure it.
The buffer is used to locally store events and vRLI Agent logs when the vRLI cluster is unreachable.
By default it is set to a maximum of 200MB. When the specified max_disk_buffer is reached, the agent begins to drop new incoming events.
The buffer size is defined in the agent configuration file either locally on each agent by altering the liagent.ini file or centrally using an agent group on the vRLI Administration UI.
Insert the following above the system log definition section to set the buffer to 2GB
[storage]
max_disk_buffer=2000 Prior to Agent 4.6 the maximum level was 2000 MB
From Agent 4.6 the maximum has been increased from 2GB to 8GB