VMware vRealize Log Insight - Installation and Configuration

VMware vRealize Log Insight as its name say gives you insight to the logs. It provided not only plain view of logs, but much more. I use it on daily basis in many modern environments and with every day I love it more and more.

Product description

As I mentioned above Log Insight is one and only tool you need to collect and analyse logs. Besides vSphere environment you can collect logs from all flavours of Windows and Linux Operating Systems. Log Insight is highly scalable – up to 12 nodes. If you calculate Large appliance size = 1500 ESXi hosts (~15000 events/second or ~225GB/day)  x12, it gives you following numbers to collect per day: 18000 ESXi hosts  (~180000 events/second or ~2700 GB/day). Check my page where you can find Log Insight Configuration Maximums VMware vRealize Log Insight Configuration Maximums.

Log Insight has intuitive and easy to use GUI with pre defined dashboards. Besides that it allows you to use interactive analytics with advanced filtering.

Installation

  1. Login to vSphere, choose Cluster where you want to install vRealize Log Insight and click Actions and Deploy OVF Template.
    VMware vRealize Log Insight - Installation and Configuration - 1
  2. Choose Local file and click Browse. Go to location where you saved downloaded OVA file. Click Open and Next.
    VMware vRealize Log Insight - Installation and Configuration - 2
  3. Review details and accept EULA.
    VMware vRealize Log Insight - Installation and Configuration - 3
  4. Choose name for virtual machine and place it in folder.
    VMware vRealize Log Insight - Installation and Configuration - 4
  5. Select configuration right for your environment:
    1. Extra Small – up to 20 ESXi hosts (~200 events/second or ~3GB/day)
    2. Small – up to 200 ESXi hosts (~2000 events/second or ~30GB/day)
    3. Medium – up to 500 ESXi hosts (~5000 events/second or ~75GB/day)
    4. Large – up to 1500 ESXi hosts (~15000 events/second or ~225GB/day)

    VMware vRealize Log Insight - Installation and Configuration - 5

  6. I selected Extra Small, because this size will be more than enough for my Lab.
  7. Select storage and disk format. Once again for my Lab deployment one and only possible choice is thin provision disk.
    VMware vRealize Log Insight - Installation and Configuration - 6
  8. Choose network where your Log Insight connects to and IP protocol.
    VMware vRealize Log Insight - Installation and Configuration - 7
  9. We are almost at the end and we have to enter few settings like hostname, IP and others.
    VMware vRealize Log Insight - Installation and Configuration - 8
  10. On the ready to complete screen review settings and click Finish to complete.
    VMware vRealize Log Insight - Installation and Configuration - 9
  11. After few minutes connect to vRealize Log Insight URL to finish configuration.
    VMware vRealize Log Insight - Installation and Configuration - 10

Configuration

General Configuration

  1. Click Next to start configuration process.
  2. This is our first installation of Log Insight so we click Start New Deployment button.
    VMware vRealize Log Insight - Installation and Configuration - 11
  3. Provide admin user Email and password.
    VMware vRealize Log Insight - Installation and Configuration - 12
  4. Enter Log Insight license key and click Save and Continue.
    VMware vRealize Log Insight - Installation and Configuration - 13
  5. Enter Email address where alerts will be sent and if you wish you can join VMware Customer Experience Improvement Program.
    VMware vRealize Log Insight - Installation and Configuration - 14
  6. On the next screen Time Configuration has to be configured. If you are ok with defaults provided by VMware click Save and Continue, otherwise enter your own NTP servers.
    VMware vRealize Log Insight - Installation and Configuration - 15
  7. On the next screen enter SMTP configuration. In my case I skipped it since I don’t have any SMTP server in my lab.
    VMware vRealize Log Insight - Installation and Configuration - 16
  8. We finally completed general configuration wizard and on last page click Finish
    VMware vRealize Log Insight - Installation and Configuration - 17
  9. On next screen we have suggestions of possible ways to use Log Insight straight away after deployment. Let’s collect logs!
    VMware vRealize Log Insight - Installation and Configuration - 18

vRealize Log Insight vSphere integration

  1. On upper right corner click button and then Administration. Click vSphere and enter vCenter Server Hostname, Username and Password. Let’s choose Collect vCenter Server events, tasks, and alarms and Configure ESXi hosts to send logs to Log Insight.
    VMware vRealize Log Insight - Installation and Configuration - 20
  2. Recent tasks in vCenter Server shows that on all ESXi hosts connected advanced settings have been configured.
    VMware vRealize Log Insight - Installation and Configuration - 21
  3. To manually configure ESXi Syslog go choose ESXi server, click Manage / Settings / Advanced System Settings / type Syslog.global.logHost and use value udp://vrli_URL:514.
    VMware vRealize Log Insight - Installation and Configuration - 22
  4. Log Insight first vSphere integration is finished.
    VMware vRealize Log Insight - Installation and Configuration - 23

vRealize Log Insight Active Directory integration

  1. In admin section go to Authentication and select Enable Active Directory support.
    VMware vRealize Log Insight - Installation and Configuration - 24
  2. Provide domain name, domain controller, username and password and choose whether you want to use LDAPS (LDAP over SSL – secure LDAP) and click Save to finish Active Directory configuration.VMware vRealize Log Insight - Installation and Configuration - 25
  3. Next step is to add Active Directory group rights to login. Because, I am doing all configuration in my lab I will add domain admin group 😉
    VMware vRealize Log Insight - Installation and Configuration - 26
  4. After that simply login to Log Insight with your Active Directory credentials.

vRealize Log Insight Windows Agent deployment

    1. vRealize Log Insight has Windows and Linux Agents that can be installed on systems. I deployed via Group Policy Log Insight Agent. If you don’t know how to do it check out my old, yet still valid  video Google Chrome deployment using group policy in Active Directory .
    2. After few minutes in section Agents members or to be more precise target computers chosen in GPO scope will be visible.
      VMware vRealize Log Insight - Installation and Configuration - 27

vRealize Log Insight integration with vRealize Operations Manager

  1. In case you want to integrate vRealize Log Insight with vRealize Operations Manager go to admin section and choose vRealize Operations.
  2. Provide hostname, username and password along with alerts and launch in context integration.
    VMware vRealize Log Insight - Installation and Configuration - 28
  3. Click Test Connection and once configuration is verified click Save.
    VMware vRealize Log Insight - Installation and Configuration - 29
  4. After few seconds integration between two products will be completed.
    VMware vRealize Log Insight - Installation and Configuration - 30

Summary

I think best summary is to show you that dashboards are populated with data and it simply works.

VMware vRealize Log Insight - Installation and Configuration - 31

In next posts I will cover more advanced topics of Log Insight like:

  1. Use CA signed SSL Certificates
  2. Installing Log Insight Content Packs
  3. Creating alerts based on events
  4. And many more

VMware vRealize Log Insight – Installation and Configuration
5 (100%) 4 votes
Wojciech Marusiak
Social Media

Wojciech Marusiak

Consultant at VMware Global, Inc.
I am innovative and experienced VMware and Windows Server Engineer with over 10 years in the IT industry specializing in VMware virtualization and Microsoft Server environment.

My experience and skills has been proven by leading vendor certifications like VMware Certified Advanced Professional 5 – Data Center Administration, VMware Certified Advanced Professional 5 – Data Center Design, VMware Certified Professional 6 - Data Center Virtualization, VMware Certified Professional 6 - Network Virtualization, Microsoft MCITP Server Administrator, ITIL V3, VMware vExpert 2014, 2015, 2016 and 2017 Award.

My blog wojcieh.net - was voted #50 in TopvBlog 2016 contest!
Wojciech Marusiak
Social Media