How to configure vC Ops 5.8 to forward logs to vC Log Insight!

Hello all,

This is something I had troubles with so I thought I would share.  You may have seen the vC Ops 5.8 release notes (found here) and realized that this is a big release.  After all there are performance improvements, security improvements, and really a lot of bug fixes.  As well there is something called Management Packs that are interesting and can provide additional information in their area, such as like Storage.  You can find more info on that here.  But what caught my eye was the fact there is a vC Ops Content Pack for Log Insight (found here).  So I wanted that to be in my lab immediately.

So first we had to upgrade vC Ops.  This was very easy and smooth as always.  I took a snapshot, and than uploaded the .pak file and applied it.  Smooth and easy.  Than we had to download the vC Ops Content Pack, and import it to Log Insight.  Both of these two tasks are easy and I am assuming you know how to do both.  If not, let me know in the comments and I will update the article to cover that.

Now we need to configure vC Ops to forward its logs to Log Insight.  That is done in the UI VM, and in the following folder:

/usr/lib/vmware-vcops/user/conf/install

We will use the vcops_loginsight_admin.sh script found there to configure vC Ops to forward to log insight.

See my example command line below.

CLI to configure syslog

Important to note that I used the reconfigure keyword above in the screenshot (since my environment was already reporting which was left over from testing and making sure things worked).  You should use the configure keyword.  In other-words, your command-line should be:

./vcops_loginsight_admin.sh configure <IP_or_FQDN_log_insight>

Once this is done you will see something like below.

Done.  Successful.

Ignore the stuff about user-.  It is not relevant, and should have been cleaned up.  And, BTW, you will see that on the vCAC virtual appliance if you manually configure syslog on it.

Now that we have traffic being forwarded to Log Insight, what would we see?  Below are two sample screenshots.  My lab is not that busy but you get the idea.

sample1 Sample2

I suspect anyone in a production environment using vC Ops will see a lot more traffic.  You now have vC Ops specific queries, and alerts you can use to help become proactive in managing your vC Ops.  If you call VMware support, it may be useful to mention that you have done this!

As always, let me know if you have questions or comments.

Update: 12/12/13 – 1005 Mountain – today I saw that the VMware KB had added an article (KB 2064455) on this.

Michael

Tagged with: ,
Posted in How To, Log Insight, vC Ops
2 comments on “How to configure vC Ops 5.8 to forward logs to vC Log Insight!
  1. Ronny says:

    Hi Michael,

    when I try to import the vCOps Content Pack, I always get the error message saying: Upload failed; Invalid content pack.
    I tried to import this content pack on two upgraded vCOps 5.8.0 systems with the above result.

    I’ve downloaded the Content Pack from the Solutions Exchange website with the link you’ve provided.

    thanks & regards,

    Ronny

    • Hi Ronny,

      The vC Ops Content Pack for Log Insight should be installed on Log Insight, and not on vC Ops. It sounds like you tried to upload on Log Insight and it failed, and than you tried to upload it to vC Ops – and it failed? Do I have that right? If so, what version of Log Insight are you running? 1.5 Technology Preview 3 cannot use the vC Ops content pack due to a bug. Generally speaking Content Packs work on GA Log Insight. Btu let me know what is going on and I will try to help.

      Michael

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: