What is VMware vRealize Log Insight for vCenter Server

0

Let’s face it, syslog collection is not as exciting as other things we would like to be doing as administrators, but often it is a necessary evil that we have to face when troubleshooting or trying to identify potential problems before they happen. Today, let’s highlight a tool that if you are not using as a vSphere administrator, you should be especially since it is free if you own vCenter Server – vRealize Log Insight Server. What is VMware vRealize Log Insight for vCenter Server?  We will take a look at licensing a bit further and How to Deploy VMware vRealize Log Insight for vCenter Server.

What is VMware vRealize Log Insight for vCenter Server?

When we think of log scraping, it isn’t terribly useful to us if there is no intelligence or analytics that can decipher what certain logs mean or how they interact and weigh in with other logs that have been gathered. VMware vRealize Log Insight delivers a platform to gain the visibility, log management, and sophisticated analytics needed to parse through logs gathered in a VMware vSphere environment.

Among the areas of interest to us when thinking about utilizing something like vRealize Log Insight are benefits gained when using a log management product that provides deep analytics. It can essentially:

  • Promote Rapid Troubleshooting and Root Cause Analysis into issues or problems
  • Monitor and Manage Machine Data at Scale
  • Create Structure from Unstructured Data
  • Lower Operating Expenses

When we think about troubleshooting an environment, time is money if we are talking about systems potentially being down and engineers spending valuable time and energy on troubleshooting. If we have a product for scraping logs that offers intelligence and analytics and presents that in such a way that we can make sense of the data, we can see how the benefits mentioned above come into play.

Is vRealize Log Insight for vCenter free?

Well, in a sense it is up to a point. For each instance of vCenter Server that you own or purchase you are entitled to a free 25 OSI license of vRealize Log Insight for vCenter. What is an OSI pack? Well, according to VMware documentation, this is “operating system instances”. There is a really good walkthrough and example given here.  This post shows the way OSI can be calculated so I will leave that to licensing discussion there. Additionally, NSX customers since NSX 6.2.4 (and beyond) customers are entitled to vRealize Log Insight for NSX at no additional charge.

Also, exciting for VMUG members, if you have a VMUG Advantage membership, you have access to vRealize Log Insight Server license for free!

How to Deploy VMware vRealize Log Insight for vCenter Server

Deploying VMware vRealize Log Insight for vCenter Server is fairly straightforward.  Download the vRealize Log Insight 4.5 server OVA appliance from VMware and deploy.  There isn’t much to note of interest in the OVA deploy as it is a standard deployment with IP configuration, etc.  Once the appliance is deployed, simply power on and let the appliance boot.

vRealize-Log-Insight-4.5-Server-booting What is VMware vRealize Log Insight for vCenter Server

vRealize Log Insight 4.5 Server booting

vRealize-Log-Insight-4.5-Server-appliance-booted What is VMware vRealize Log Insight for vCenter Server

vRealize Log Insight 4.5 Server appliance booted

After connecting to the web interface, we are greeted with the Setup dialog box ready for configuration of the appliance.

Launch-Setup-of-vRealize-Log-Insight-4.5-Server What is VMware vRealize Log Insight for vCenter Server

Launch Setup of vRealize Log Insight 4.5 Server

On the next screen we can click teh Start New Deployment button to create the new deployment of vRealize Log Insight server.

Start-New-Deployment-of-vRealize-Log-Insight-Server-4.5 What is VMware vRealize Log Insight for vCenter Server

Start New Deployment of vRealize Log Insight Server 4.5

Deployment process begins.

Start-New-Deployment-begins What is VMware vRealize Log Insight for vCenter Server

Start New Deployment begins

On the first screen, we setup the Admin Credentials for the admin user to access the vRealize Log Insight server.

Setup-Admin-credentials-in-vRealize-Log-Insight-Setup-process What is VMware vRealize Log Insight for vCenter Server

Setup Admin credentials in vRealize Log Insight Setup process

Add your License key for vRealize Log Insight Server, or you can skip this during the initial setup.

Setup-License-Key-for-vRealize-Log-Insight-4.5-Server What is VMware vRealize Log Insight for vCenter Server

Setup License Key for vRealize Log Insight 4.5 Server

Time configuration.  The setup process prepopulates the NTP servers with VMware specific NTP servers.

Setup-Time-configuration What is VMware vRealize Log Insight for vCenter Server

Setup Time configuration

Setup SMTP configuration for email alerting, or you can simply skip this test during the initial setup.

Setup-SMTP-configuration-for-vRealize-Log-Insight-Server What is VMware vRealize Log Insight for vCenter Server

Setup SMTP configuration for vRealize Log Insight Server

We finally get to the Setup complete screen.  Once we click Finish, we are taken to the Ready to Injest Data screen.

Initial-Setup-Configuration-completes What is VMware vRealize Log Insight for vCenter Server

Initial Setup Configuration completes

On the Ready to Ingest Data screen, this is where we actually configure our connection to our vSphere environment.  Click teh Cofnigure vSphere Integration link to configure.

Begin-setting-up-vSphere-Integration What is VMware vRealize Log Insight for vCenter Server

Begin setting up vSphere Integration

Populate the vSphere Integration Hostname, Username, and Password values for vCenter Server.  Notice the Configure ESXi hosts to send logs to Log Insight is checked by default.

Create-a-connection-to-your-vCenter-server What is VMware vRealize Log Insight for vCenter Server

Create a connection to your vCenter server

vRealize Log Insight Server ESXi Host Syslog Configuration

When using the automatic configuration with the vSphere Integration setup, I saw the errors listed below which referred me to the KB listed – http://kb.vmware.com/kb/2003322.

vRealize-Log-Insight-Server-ESXI-host-Syslog-configuration What is VMware vRealize Log Insight for vCenter Server

vRealize Log Insight Server ESXI host Syslog configuration

Using the esxcli command we configure the syslog service and the remote host we want to use (our vRealize Log Insight Server), and also allow syslog connectivity via the ESXi host firewall.  After configuring both, we refresh the firewall and reload the syslog service.  We can also use the nz command to test connectivity.

Configure-Syslog-connection-for-ESXi-hosts What is VMware vRealize Log Insight for vCenter Server

Configure Syslog connection for ESXi hosts

Once, I configured the Syslog firewall exception and configured the remote host, the automatic configuration completed successfully.

vRealize-Log-Insight-ESXi-host-automatic-configuration What is VMware vRealize Log Insight for vCenter Server

vRealize Log Insight ESXi host automatic configuration

Viewing vRealize Log Insight Server Information

Once we have vCenter Server and our ESXi hosts sending information, we should start to see data populating in the default General – Overview dashboard.

vRealize-Log-Insight-Server-starting-to-pull-data What is VMware vRealize Log Insight for vCenter Server

vRealize Log Insight Server starting to pull data

Using the Interactive Analytics tool, we can drill down into the events pulled and get insights into issues, etc.

vRealize-Log-Insight-Server-Interactive-Analytics What is VMware vRealize Log Insight for vCenter Server

vRealize Log Insight Server Interactive Analytics

Thoughts

What is VMware vRealize Log Insight for vCenter Server? It is a great tool that is provided for free when you have vCenter Server licensing that allows much more insightful analytics into vCenter and ESXi host syslogs collection. Let’s face it, gathering and parsing syslogs manually is virtually impossible and cumbersome. Having the right tools to do this intuitively provides benefits to troubleshooting and lowers TCO. If you want to take syslog and best practices even further, Runecast Analyzer is definitely the way to go. Check out our post covering Runecast here.