Courtesy of Virten.net
VMware gives away a 25-OSI pack of vRealize Log Insight 3.3 for all users with a supported vCenter Server license. VMware vRealize Log Insight is a log management software with intuitive dashboards, sophisticated analytics and broad third-party extensibility. It provides deep operational visibility and faster troubleshooting.
Log Insight is not a new product. I’ve already written about it during the beta phase and the final product was introduced back in 2013. With the release of vSphere 6.0 Update 2, VMware has included a 25-OSI package to all vCenter installations allowing all customers to use the product in small environments for free.
In this post I am goging to explain how to obtain the 25-OSI pack and deploy Log Insight for vCenter.
VMware vRealize Log Insight 3.3.1 for vCenter Server is available as virtual appliances. The download has been added to the vSphere 6.0 section, but there is no difference to the “VMware vRealize Log Insight 3.3.1” package, available in the vRealize section.
Download vSphere 6.0
Log Insight 3.3 for vCenter Server will accept any vCenter Server 6.0 Standard, Enterprise, or Enterprise Plus license. For vCenter Server 5.x users, a license key can be found on the Log Insight 3.3 for vCenter Server download page:
Use the Deploy OVF Template function to install the Appliance:
The extra small configuration supports up to 20 ESXi hosts. To take full advantage of the 25-OSI package, and generally for production, the small configuration is recommended. The largest deployment supports up to 1500 ESXi hosts (15,000 events/second). There is no need to make a final decition here. The appliances can be extended later.
After finishing the deployment wizard, wait a couple of minutes until the Appliances has finised initial configuration tasks. The appliances is available when the following screen is visible in the console:
To configure VMware Log Insight, open a browser and navigate to the URL mentioned in the console and select Next > Start New Deployment
Add a License key. You can either use your vCenter Server 6.0 License key, or the key provided at the Log Insight download page.
Log Insight is now ready to collect logs. The following sources can be configured:
- vSphere Integration, collects data from vCenter Server and ESXi hosts
- Agents installed on Linux or Windows systems
- Syslog Server
To add your vSphere Environment to Log Insight, open Configure vSphere integration »
Add your vCenter Server:
This will automatically configure the vCenter Server, and all ESXi hosts to send their logs to the appliance. You can verify the state, and add/remove ESXi hosts on the detail page:
Logfiles are now ready to be analysed. I’ve deployed 2 ESXi hosts with a vCenter Server, so there are still 22 free licenses left to add more ESXi hosts, or other systems.
VMware Log Insight is not limited to VMware products. It’s intended as central logging system. It is shipped with the following agents:
- VMware vRealize Log Insight 3.3.1 – Window agent
- VMware vRealize Log Insight 3.3.1 – Linux agent 32/64-bit (RPM)
- VMware vRealize Log Insight 3.3.1 – Linux agent 32/64-bit (Debian)
- VMware vRealize Log Insight 3.3.1 – Linux agent 32/64-bit (binary)
I’m installing the Linux Agent on a Debian based Ubuntu 14.04.4 LTS.
root@aztec:~# dpkg -i VMware-Log-Insight-Agent_3.3.1-3636434.deb Vorbereitung zum Entpacken von VMware-Log-Insight-Agent_3.3.1-3636434.deb ... Entpacken von vmware-log-insight-agent (3.3.1-3636434) ... vmware-log-insight-agent (3.3.1-3636434) wird eingerichtet ... Starting VMware Log Insight Agent: * Installation completed. ATTENTION: Please edit configuration file: /etc/liagent.ini For online documentation please visit: https://www.vmware.com/support/pubs/log-insight-pubs.html Trigger für ureadahead (0.100.0-16) werden verarbeitet ... ureadahead will be reprofiled on next reboot
The Agent needs to know the address of the Log Insight server. Any further configuration can then be done from the Log Insight Management console. Edit the configuration file /etc/liagent.ini and set the hostname to your Log Insight server.
The Linux host should now appear in the Agent Configuration.
Groups can be created to deploy the same configuration on a large number of hosts. I’ve created a group for Linux Hosts and added the gathering of /var/log/syslog:
I’ve also added the Log Insight Server as Syslog server on my router. Very nice and quick solution for small networks. But what is the outstanding feature of VMware vSphere Log Insight? Content Packs!
VMware vSphere Log Insight is not just a log aggregator, it also has a deep understanding of log entries, allowing administrators to find quick solutions for problems. Here are some examples from the VMware vSphere Content pack, which is available by default: