vCenter Operations 5.7.1 + vCenter Log Insight = Maximum Visibility

Last week VMware released an update on vCenter Operations Manager, version 5.7.1 is now available. This latest version includes some new features like the Performance Report Pack, Launch in Context, standard vSphere Dashboards in the custom UI and integration with vCenter Log Insight. vCenter Log In…what? Yes, vCenter Log Insight is new very cool tool which will become GA in Q3 2013 but is available now for free as a beta product.

vCenter Log Insight delivers automated log management through log analytics, aggregation and search. Log Insight analyzes your log data and offers insight relational information based on standard VMware log files. Log Insight comes as a virtual appliance which can be connected to both vCenter Server and vCenter Operations Manager.

Let’s first take a look at the vCenter Log Insight webinterface:

The interface shows the available dashboard options on the left side of the screen, while you can configure the application using the buttons on the top right of the screen. Log Insight is using so called content-packs which offer the intelligence about the various log files, or as John Herlocker puts it:

Through this content pack mechanism, we are putting some of the same tools and knowledge in your hands that our own support teams use to resolve customer support cases. We find that customers learn something interesting (or even concerning) about their vSphere environment during their first use of Log Insight, even if they have never looked at a vSphere log before.

By default the vSphere content pack is included, more content packs are expected…maybe even from 3rd party vendors.

During the installation you can link both your vCenter Server and vCenter Operations Manager installation to Log Insight. When you want ESXi log messages to appear in Log Insight, you have to configure the Log Insight server as a syslog server. This can be achieved in several ways:

1. Through the Advanced Settings option on your ESXi host and setting the Syslog.global.logHost option. Don’t forget to open port 514 outbound!
2. Through a script as described in this article. A powershell option is also available.
3. Using the configure-esxi script which is available on your Log Insight server; the syntax for this script is:

   configure-esxi --username 'my-vc-user' --server myvc.mydomain.com --target udp://loginsight.mydomain.com

Log Insight can use Syslog through UDP/TCP on port 514 and TCP on port 1514 (SSL). Also note some problems with the ESXi syslog service stop functioning after a failed network connection.

After you have configured your ESXi hosts you will see events will show up in the Log Insight dashboards:

Log Insight / vCenter Operations Manager Integration

Ok, now we have Log Insight up and running, let’s take a look at the vCenter Operations Manager integration…only available in version 5.7.1. or newer. The magic button is available in the action pull down menu.

The option “Search for logs in vCenter Log Insight” will show you:

• The Log Insight home page when selecting the world object;
• The interactive analysis screen for the vCenter host and all connected ESXi hosts when selecting a vCenter Object in vCops;
• The interactive analysis screen for all linked ESXi hosts when selecting a datacenter or cluster object;
• When selecting a specific ESXi hosts, this option will only show information on that particular host.
• When selecting a virtual machine, Log Insight will show both virtual machine and ESXi log information.

All together Log Insight with vCenter Operations Manager offers you a lot of valuable information on what is happening in your environment. Just go ahead and give it a try your self!

Further reading…

On the VMware website you will find some nice videos on Log Insight, also don’t forget to check this video recorded by Eric Sloof.William Lam wrote this nice article on forwarding logs of other VMware products to Log Insight.