vSphere 6.5

What is VMware vRealize Log Insight for vCenter Server

Let’s face it, syslog collection is not as exciting as other things we would like to be doing as administrators, but often it is a necessary evil that we have to face when troubleshooting or trying to identify potential problems before they happen. Today, let’s highlight a tool that if you are not using as a vSphere administrator, you should be especially since it is free if you own vCenter Server – vRealize Log Insight Server. What is VMware vRealize Log Insight for vCenter Server?  We will take a look at licensing a bit further and How to Deploy VMware vRealize Log Insight for vCenter Server.

What is VMware vRealize Log Insight for vCenter Server?

When we think of log scraping, it isn’t terribly useful to us if there is no intelligence or analytics that can decipher what certain logs mean or how they interact and weigh in with other logs that have been gathered. VMware vRealize Log Insight delivers a platform to gain the visibility, log management, and sophisticated analytics needed to parse through logs gathered in a VMware vSphere environment.

Among the areas of interest to us when thinking about utilizing something like vRealize Log Insight are benefits gained when using a log management product that provides deep analytics. It can essentially:

  • Promote Rapid Troubleshooting and Root Cause Analysis into issues or problems
  • Monitor and Manage Machine Data at Scale
  • Create Structure from Unstructured Data
  • Lower Operating Expenses

When we think about troubleshooting an environment, time is money if we are talking about systems potentially being down and engineers spending valuable time and energy on troubleshooting. If we have a product for scraping logs that offers intelligence and analytics and presents that in such a way that we can make sense of the data, we can see how the benefits mentioned above come into play.

Is vRealize Log Insight for vCenter free?

Well, in a sense it is up to a point. For each instance of vCenter Server that you own or purchase you are entitled to a free 25 OSI license of vRealize Log Insight for vCenter. What is an OSI pack? Well, according to VMware documentation, this is “operating system instances”. There is a really good walkthrough and example given here.  This post shows the way OSI can be calculated so I will leave that to licensing discussion there. Additionally, NSX customers since NSX 6.2.4 (and beyond) customers are entitled to vRealize Log Insight for NSX at no additional charge.

Also, exciting for VMUG members, if you have a VMUG Advantage membership, you have access to vRealize Log Insight Server license for free!

How to Deploy VMware vRealize Log Insight for vCenter Server

Deploying VMware vRealize Log Insight for vCenter Server is fairly straightforward.  Download the vRealize Log Insight 4.5 server OVA appliance from VMware and deploy.  There isn’t much to note of interest in the OVA deploy as it is a standard deployment with IP configuration, etc.  Once the appliance is deployed, simply power on and let the appliance boot.

vRealize Log Insight 4.5 Server booting
vRealize Log Insight 4.5 Server appliance booted

After connecting to the web interface, we are greeted with the Setup dialog box ready for configuration of the appliance.

Launch Setup of vRealize Log Insight 4.5 Server

On the next screen we can click teh Start New Deployment button to create the new deployment of vRealize Log Insight server.

Start New Deployment of vRealize Log Insight Server 4.5

Deployment process begins.

Start New Deployment begins

On the first screen, we setup the Admin Credentials for the admin user to access the vRealize Log Insight server.

Setup Admin credentials in vRealize Log Insight Setup process

Add your License key for vRealize Log Insight Server, or you can skip this during the initial setup.

Setup License Key for vRealize Log Insight 4.5 Server

Time configuration.  The setup process prepopulates the NTP servers with VMware specific NTP servers.

Setup Time configuration

Setup SMTP configuration for email alerting, or you can simply skip this test during the initial setup.

Setup SMTP configuration for vRealize Log Insight Server

We finally get to the Setup complete screen.  Once we click Finish, we are taken to the Ready to Injest Data screen.

Initial Setup Configuration completes

On the Ready to Ingest Data screen, this is where we actually configure our connection to our vSphere environment.  Click teh Cofnigure vSphere Integration link to configure.

Begin setting up vSphere Integration

Populate the vSphere Integration Hostname, Username, and Password values for vCenter Server.  Notice the Configure ESXi hosts to send logs to Log Insight is checked by default.

Create a connection to your vCenter server

vRealize Log Insight Server ESXi Host Syslog Configuration

When using the automatic configuration with the vSphere Integration setup, I saw the errors listed below which referred me to the KB listed – http://kb.vmware.com/kb/2003322.

vRealize Log Insight Server ESXI host Syslog configuration

Using the esxcli command we configure the syslog service and the remote host we want to use (our vRealize Log Insight Server), and also allow syslog connectivity via the ESXi host firewall.  After configuring both, we refresh the firewall and reload the syslog service.  We can also use the nz command to test connectivity.

esxcli system syslog conig set --loghost='udp://<vrealize log insight server>:514'
esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network firewall refresh
esxcli system syslog reload
nc -z <vrealize log insight server IP/FQDN> 514
Configure Syslog connection for ESXi hosts

Once, I configured the Syslog firewall exception and configured the remote host, the automatic configuration completed successfully.

vRealize Log Insight ESXi host automatic configuration

Viewing vRealize Log Insight Server Information

Once we have vCenter Server and our ESXi hosts sending information, we should start to see data populating in the default General – Overview dashboard.

vRealize Log Insight Server starting to pull data

Using the Interactive Analytics tool, we can drill down into the events pulled and get insights into issues, etc.

vRealize Log Insight Server Interactive Analytics


What is VMware vRealize Log Insight for vCenter Server? It is a great tool that is provided for free when you have vCenter Server licensing that allows much more insightful analytics into vCenter and ESXi host syslogs collection. Let’s face it, gathering and parsing syslogs manually is virtually impossible and cumbersome. Having the right tools to do this intuitively provides benefits to troubleshooting and lowers TCO. If you want to take syslog and best practices even further, Runecast Analyzer is definitely the way to go. Check out our post covering Runecast here.

Subscribe to VirtualizationHowto via Email 🔔

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Brandon Lee

Brandon Lee is the Senior Writer, Engineer and owner at Virtualizationhowto.com and has over two decades of experience in Information Technology. Having worked for numerous Fortune 500 companies as well as in various industries, Brandon has extensive experience in various IT segments and is a strong advocate for open source technologies. Brandon holds many industry certifications, loves the outdoors and spending time with family.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.