Anyone who has ever been an administrator or operator of an IT environment can agree, it is no fun digging through logs in the middle of an issue. Even though vSphere 6.5 has a great, searchable log browser for ESXi hosts, when something is going wrong we all want to be able to quickly and easily identify the problem. Enter VMware vRealize Log Insight, a VMware product that is often overlooked, but incredibly valuable. VMware Log Insight is the solution to the problems we know we have all had, but are usually too busy to fix, and many of us already own thanks to a VMware licensing change wee may have missed.
Before we talk about the good news you probably did not know about when it comes to VMware Log Insight, let’s start with the basics.
What is VMware Log Insight?
VMware Log Insight is part of VMware’s vRealize suite, which seeks to automate and orchestrate the software defined datacenter, making it easier for IT organizations to spend their time innovating instead of doing receptive tasks, and in the case of Log Insight, troubleshooting and root cause analysis. Some of the key features include:
- An easy to use interface – no more grep!
- Dashboards – making it easy for operators to get a quick look at their environment
- Role-based Access Control – ensuring only the people who need this depth of view have access
- Interactive Analytics – let Log Insight do the hard work for you, and easily find what you are looking for
My two favorite of those features are dashboards and interactive analytics. The dashboard presents you with a view of what is going in in your environment, and can get as specific as you need it too, and is fully customizable. Here is an interesting dashboard from Log Insight:
As you can see, this os an overview of authentication. There are also views for failed logins. I picked this view to show you for a couple of reasons. First, it is always a good idea to keep an eye on authentication. Sure, we all mistype a password once in a while, but if you see consistent failed logins it should be a signal to dig a little deeper into what is going on. Secondly, this dashboard also shows many other available in the left navigation pane. These are all things we can get instant insight on with this VMware tool. For example, I may want to take a deeper look as to how DRS is running, and Log Insight makes that quick and easy for me to do.
As you can see there is a tab for Interactive Analytics. Interactive Analytics lets you drill down on specific events or log information.
In this case I am looking at a specific host. The use case for looking at a single host like this may be an issue with the host, such as it keeps disconnecting from vCenter. As we all know, hosts also do weird things when some sort of failure is eminent, so this is away to keep an eye on one causing trouble. You will notice in the right hand corner of the screen there is a button for Add to Dashboard. You can add anything you come up with in Interactive Analytics right to your dashboard. You will also notice we can add as many filters as we would like to get the fully customized view we are looking for based on what is going on in our VMware vSphere environment.
VMware Licensing Gives You Log Insight
When I say VMware licensing, I am talking about VMware vCenter server licensing. As we all know, vCenter Server is the brains of any large vSphere deployment, and we all already own it. VMware began bundling a 25-OSI Log Insight bundle into vCenter Server in 2016, which you can read about more in this VMware KB.
When it comes to VMware licensing, vRealize Log Insight is licensed by the OSI or OS Instance. You will need a vRealize Log Insight OSI for vCenter Server, ESXi hosts, Virtual Machines, and other vSphere components like NSX if you are looking to leverage the power of Log Insight. Remember, VMware vRealize Log Isight is capable of collecting logs and performing analytics on more than just VMware vSphere. At this time, there are a staggering 73 content packs available for VMware vRealize Log Insight on the VMware Marketplace, which means many of the solutions in customer environments can benefit from vRealize Log Insight. You can purchase additional OSI licenses in packs of 25, which is a granularity many are thrilled with. By purchasing linceces in packs of 25 instead of say 1000, we can be assured that we have not paid for VMware licenses we are not even using.
Because you are already licensed for Log Insight if you own VMware vCenter server, it is very tempting to deploy. If you don’t have a development environment however, you may be concerned with deploying a brand new product into production, which can be daunting if you do not have any experience with it. Further more, you may also need to work with operations team members and show them the new product before it is deployed. Our friends at VMware know that this is commonly encountered with many of their products, so they have provided a solution.
vRealize Log Insight is available in a number of VMware Hands-on Labs such as vSphere With Operations Management – Getting Started. To see what other labs VMware log insight is available in, simply search for “log insight” in HOL. HOL is an easy way to test out any vSphere product you are interested in. It is also a great learning resource for getting sone hands on experience without having to worry about impacting a production environment. For example, you may want to get used to the NSX management interface before you deploy it, or show it to other members of your team to get them on board. HOL is a great way to do this.
VMware’s vRealize Log Insight is not something that many are familiar with, but it is an easy to use tool that most VMware customers already own in some capacity. The 25 OSI VMware licensing capacity that comes with VMware vCenter server is enough for organizations to realize the value of Log Insight before they commit to it. Log Insight is a handy tool that helps administrators and operators troubleshoot their environment quickly and easily, and is easy to get started with.
To learn more about Log Insight, be sure to check out VMware’s official product page.