Administering vRealize

Log Insight
July 23, 2020
vRealize Log Insight 4.8
Administering vRealize Log Insight

You can find the most up-to-date technical documentation on the VMware website at:

[Link]

If you have comments about this documentation, submit your feedback to

docfeedback@[Link]

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
[Link]

©
Copyright 2014-2019 VMware, Inc. All rights reserved. Copyright and trademark information.

VMware, Inc. 2
 Contents

Administering vRealize Log Insight 7

1 Upgrading vRealize Log Insight 8

vRealize Log Insight Upgrade Path 8
Upgrade to vRealize Log Insight 4.0 or Later 8
Upgrade to vRealize Log Insight 3.6 10

2 Managing vRealize Log Insight User Accounts 11

User Management Overview 11
Role-Based Access Control 12
Using Filtering to Manage User Accounts 12
Create a New User Account in vRealize Log Insight 13
Configure VMware Identity Manager Access to Active Directory Groups for vRealize Log Insight 14
Import an Active Directory Group to vRealize Log Insight 15
Authenticating Users with Cross-Domain Group Membership 17
Define a Data Set 17
Create and Modify Roles 18
Delete a User Account or Group from vRealize Log Insight 19

3 Configuring Authentication 20
Enable User Authentication Through VMware Identity Manager 20
Enable User Authentication Through Active Directory 22
Configure the Protocol to Use for Active Directory 23

4 Configuring vRealize Log Insight 24

vRealize Log Insight Configuration Limits 24
Configure Data Retention 25
Configuring Virtual Appliance Settings 26
Configure the Root SSH Password for the vRealize Log Insight Virtual Appliance 26
Change the Network Settings of the vRealize Log Insight Virtual Appliance 27
Increase the Storage Capacity of the vRealize Log Insight Virtual Appliance 28
Add Memory and CPU to the vRealize Log Insight Virtual Appliance 29
Assign a License to vRealize Log Insight 30
Log Storage Policy 31
Managing System Notifications 31
System Notifications 32
Configuring Destinations for vRealize Log Insight System Notifications 36
Add a vRealize Log Insight Event Forwarding Destination 39

VMware, Inc. 3
Administering vRealize Log Insight

Configure vRealize Log Insight Event Forwarding with SSL 42

Using Event Forwarding Filters in Interactive Analytics 42
Synchronize the Time on the vRealize Log Insight Virtual Appliance 43
Configure the SMTP Server for vRealize Log Insight 44
Install a Custom SSL Certificate 44
Generate a Self-Signed Certificate 46
Generate a Certificate Signing Request 47
Request a Signature from a Certificate Authority 48
Concatenate Certificate Files 48
Upload Signed Certificate 49
Configure SSL Connection Between the vRealize Log Insight Server and the Log Insight Agents
50
Change the Default Timeout Period for vRealize Log Insight Web Sessions 53
Archiving 54
Enable or Disable Data Archiving in vRealize Log Insight 54
Format of the vRealize Log Insight Archive Files 55
Import a vRealize Log Insight Archive into vRealize Log Insight 56
Export a Log Insight Archive to a Raw Text File or JSON 56
Restart the vRealize Log Insight Service 57
Power Off the vRealize Log Insight Virtual Appliance 58
Download a vRealize Log Insight Support Bundle 59
Join or Leave the VMware Customer Experience Improvement Program 60

5 Managing vRealize Log Insight Clusters 61

Add a Worker Node to a vRealize Log Insight Cluster 61
Deploy the vRealize Log Insight Virtual Appliance 61
Join an Existing Deployment 64
Remove a Worker Node from a vRealize Log Insight Cluster 65
Working with an Integrated Load Balancer 66
Enable the Integrated Load Balancer 67
Query the Results of In-Production Cluster Checks 68

6 Ports and External Interfaces 69

7 Monitor the Status of the vRealize Log Insight Agents 73

8 Enable Agent Auto-Update from the Server 75

9 Centralized Agent Configurations and Agent Groups 76

Agent Group Configuration Merging 77
Create an Agent Group 77
Edit an Agent Group 79

VMware, Inc. 4
Administering vRealize Log Insight

Add a Content Pack Agent Group as an Agent Group 79

Delete an Agent Group 80

10 Monitoring vRealize Log Insight 81

Check the Health of the vRealize Log Insight Virtual Appliance 81
Monitor Hosts That Send Log Events 82
Configure a System Notification to Report on Inactive Hosts 83

11 Integrating vRealize Log Insight with VMware Products 85

Connect vRealize Log Insight to a vSphere Environment 86
vRealize Log Insight as a Syslog Server 88
Configure an ESXi Host to Forward Log Events to vRealize Log Insight 88
Modify an ESXi Host Configuration for Forwarding Log Events to vRealize Log Insight 89
vRealize Log Insight Notification Events in vRealize Operations Manager 91
Configure vRealize Log Insight to Pull Events, Tasks, and Alarms from vCenter Server Instance 92
Using vRealize Operations Manager with vRealize Log Insight 92
Requirements for Integrating With vRealize Operations Manager 93
Configure vRealize Log Insight to Send Notification Events to vRealize Operations Manager 94
Enable Launch in Context for vRealize Log Insight in vRealize Operations Manager 95
Disable Launch in Context for vRealize Log Insight in vRealize Operations Manager 100
Add a DNS Search Path and Domain 100
Remove the vRealize Log Insight Adapter 101
vRealize Operations Manager Content Pack for vRealize Log Insight 102

12 Security Considerations for vRealize Log Insight 104

Ports and External Interfaces 104
vRealize Log Insight Configuration Files 107
vRealize Log Insight Public Key, Certificate, and Keystore 108
vRealize Log Insight License and EULA File 108
vRealize Log Insight Log Files 109
Enable Debug Level for User Audit Log Messages 111
vRealize Log Insight User Accounts 112
vRealize Log Insight Firewall Recommendations 112
Security Updates and Patches 113

13 Backup, Restore, and Disaster Recovery 114

Backup, Restore, and Disaster Recovery Overview 114
Using Static IP Addresses and FQDN 115
Planning and Preparation 116
Backup Nodes and Clusters 117
Backup Linux or Windows Agents 118

VMware, Inc. 5
Administering vRealize Log Insight

Restore Nodes and Clusters 118

Changing Configurations After Restoration 119
Restore to the Same Host 120
Restore to a Different Host 120
Verify Restorations 123
Disaster Recovery 123

14 Troubleshooting vRealize Log Insight 125

Cannot Log In to vRealize Log Insight on Internet Explorer 125
vRealize Log Insight Runs Out of Disk Space 126
Import of Archived Data Might Fail 126
Use the Virtual Appliance Console to Create a Support Bundle of vRealize Log Insight 127
Reset the Admin User Password 127
Reset the Root User Password 128
Alerts Could Not Be Delivered to vRealize Operations Manager 129
Unable to Log In Using Active Directory Credentials 130
SMTP does not work with STARTTLS option enabled 131
Upgrade Fails Because the Signature of the .pak file Cannot Be Validated 132
Upgrade Fails with an Internal Server Error 132
Missing vmw_object_id Field in the First Log Message After Integration with VMware Products 133

VMware, Inc. 6
Administering vRealize Log Insight
®
Administering vRealize Log Insight provides information about the administration of VMware vRealize™
Log Insight™, including how to manage user accounts and how to configure integration with other
VMware products. It also includes information about managing product security and upgrading your
deployment.

The information is written for experienced Windows or Linux system administrators who are familiar with
virtual machine technology and datacenter operations.

VMware, Inc. 7
 1
Upgrading vRealize Log Insight

You can upgrade vRealize Log Insight to version 4.8 by following an incremental upgrade path. The
upgrade includes automatic upgrading of nodes in a cluster.

To download the PAK files for vRealize Log Insight, go to the Download VMware vRealize Log Insight
page.

This chapter includes the following topics:

n vRealize Log Insight Upgrade Path

n Upgrade to vRealize Log Insight 4.0 or Later

n Upgrade to vRealize Log Insight 3.6

vRealize Log Insight Upgrade Path

The upgrade path to follow depends on which version of vRealize Log Insight is installed the version you
are upgrading to.

vRealize Log Insight upgrades must be done incrementally. For example, to upgrade from version 4.5 to
version 4.7, you apply the 4.6 upgrade to 4.5 and then upgrade from 4.6 to 4.7. You must upgrade to
each intermediate release.

You can also view supported upgrade paths on the VMWare Product Interoperability Matrixes site.

Upgrade to vRealize Log Insight 4.0 or Later

You can incrementally upgrade a cluster to vRealize Log Insight 4.0 or later. For example, to upgrade
from version 3.6 to version 4.3, you apply the 4.0 upgrade to 3.6 and then upgrade from 4.0 to 4.3.

Upgrading vRealize Log Insight must be done from the master node's FQDN. Upgrading using the
Integrated Load Balancer IP address is not supported.

VMware, Inc. 8
Administering vRealize Log Insight

During upgrade, the master node is upgraded first, and restarts. Each of the cluster nodes is upgraded
sequentially. You can see the status of the rolling upgrade on the Admin > Cluster page. If the integrated
load balancer is configured, its IPs are migrated among the cluster nodes so cluster services, including
UI, API, and ingestion of incoming events, remain available throughout the rolling upgrade. Low-level
details are written to the file /storage/core/loginsight/var/[Link] on each individual node. A
system notification is sent when the upgrade finishes successfully.

If a problem is encountered affecting one or more of the nodes during the upgrade process, the entire
cluster is rolled back to the original, working version. Because configuration changes performed after the
upgrade started might be inconsistent or invalid, the configuration is reverted to a known-good state
captured before upgrade. No ingested events are lost. Progress is written to the file /storage/core/
loginsight/var/[Link] on each individual node. A system notification is sent when rollback
finishes. After the issue is investigated and fixed, you can retry the upgrade.

After upgrade, all nodes are placed in a connected state and brought online even if they were in
maintenance before upgrade.

Prerequisites

n Verify that you are applying the correct upgrade to version vRealize Log Insight . For more
information about supported upgrade paths, see vRealize Log Insight Upgrade Path.

n Create a snapshot or backup copy of the vRealize Log Insight virtual appliance.

n Obtain a copy of the vRealize Log Insight upgrade bundle .pak file for the release you are upgrading
to.

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

n Make a note of any nodes you are upgrading that are in maintenance mode. When the upgrade is
finished, you must move them from the state Connected to Maintenance mode.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Cluster.

3 Click Upgrade from PAK to upload the .pak file.

4 Accept the new EULA to complete the upgrade procedure.

What to do next

After the master node upgrade process is complete, you can view the remaining upgrade process, which
is automatic.

Check for the email sent to the Admin to confirm the upgrade completed successfully.

After upgrade, all nodes are brought online even if they were in maintenance mode before the upgrade.
Move these nodes back to maintenance mode as needed.

VMware, Inc. 9
Administering vRealize Log Insight

Upgrade to vRealize Log Insight 3.6

You can automatically upgrade a cluster to vRealize Log Insight 3.6.

Upgrading vRealize Log Insight must be done from the master node's FQDN. Upgrading using the
Integrated Load Balancer IP address is not supported.

During the upgrade, the master node is upgraded first, and restarts. Then each of the cluster nodes is
upgraded sequentially. You can see the current status of the rolling upgrade seen on the Admin >
Cluster page. If the integrated load balancer is configured, its IPs are migrated among the cluster nodes
so cluster services, including UI, API, and ingestion of incoming events, remain available throughout the
rolling upgrade. Low-level details are written to the [Link] file on each individual node. A system
notification is sent when upgrade completes successfully.

If an issue is encountered affecting one or more of the nodes during the upgrade process, the entire
cluster is automatically rolled back to the original, working version. Because configuration changes
performed after the upgrade started might be inconsistent or invalid, the configuration is reverted to a
known-good state captured before upgrade. No ingested events are lost. Progress is written to
[Link] file on each individual node. A system notification is sent when rollback finishes. After the
issue is investigated and fixed, you can retry the upgrade.

Prerequisites

n Verify that you are applying the upgrade for a supported upgrade path. See vRealize Log Insight
Upgrade Path.

n Create a snapshot or backup copy of the vRealize Log Insight virtual appliance.

n Obtain a copy of the vRealize Log Insight upgrade bundle .pak file for the release you are upgrading
to.

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Cluster.

3 Click Upgrade from PAK to upload the .pak file.

4 Accept the new EULA to complete the upgrade procedure.

What to do next

After the master node upgrade process is complete, you can view the remaining upgrade process which
is automatic.

Check for the email sent to the Admin to confirm the upgrade completed successfully.

VMware, Inc. 10
 2
Managing vRealize Log Insight
User Accounts

Administrators can create user accounts and roles to provide access to the vRealize Log Insight web
interface.

Only users with the Edit Admin permission can create and edit user accounts. However, users can
change their own email and account password without having Edit Admin permission.

This chapter includes the following topics:

n User Management Overview

n Role-Based Access Control

n Using Filtering to Manage User Accounts

n Create a New User Account in vRealize Log Insight

n Configure VMware Identity Manager Access to Active Directory Groups for vRealize Log Insight

n Import an Active Directory Group to vRealize Log Insight

n Authenticating Users with Cross-Domain Group Membership

n Define a Data Set

n Create and Modify Roles

n Delete a User Account or Group from vRealize Log Insight

User Management Overview

System administrators use a combination of user logins, role-based access control, permissions, and
data sets to manage vRealize Log Insight users. Role-based access control lets administrators manage
users and the tasks that they can perform.

Roles are sets of permissions required to perform particular tasks. System administrators define roles as
part of defining security policies, and grant the roles to users. To change the permissions and tasks
associated with a particular role, the system administrator updates the role settings. The updated settings
take effect for all users associated with the role.

n To allow a user to perform a task, the system administrator grants the role to the user.

n To prevent a user from performing a task, the system administrator revokes the role from the user.

VMware, Inc. 11
Administering vRealize Log Insight

Managing access, roles, and permissions for each user is based on their user login account. Each user
can be granted multiple roles and permissions.

Users who cannot view or access certain objects or cannot perform certain operations were not granted
the permissions to do so.

Role-Based Access Control

Role-based access control lets system administrators control user access to vRealize Log Insight and
control tasks that users can perform after they log in. To implement role-based access control, system
administrators associate or revoke permissions and roles with or from user login accounts

Users
System administrators can control the access and actions of each user by granting or revoking
permissions and roles to or from the login account of the user.

Permissions

Permissions control the allowed actions in vRealize Log Insight. Permissions apply to particular
administrative or user tasks in vRealize Log Insight. For example, you can grant the View Admin
permission to allow a user to view the vRealize Log Insight administrative settings.

Data Sets

Data sets consist of a set of filters. You can use data sets to provide users with access to specific
content by associating a data set with a role.

Roles

Roles are collections of permissions and data sets that can be associated with users. Roles provide a
convenient way to package all the permissions required to perform a task. One user can be assigned
multiple roles.

Using Filtering to Manage User Accounts

You can search for a user or set of users by specifying a search filter.

Filtering is done from the Users and Groups tab on the Access Control page. To go to the page, click
Administration from the drop-down menu icon , click Access Control under the Management menu,
and select the Users and Groups tab.

The search text box is located near the top of the page and contains the phrase Filter by username.

The search function filters results as you type, returning user names that contain the input pattern. For
example, if you have user names John_Smith, John_Doe, and Helen_Jonson, when you type the letter
J, search returns all user names that include that letter, for this example John_Smith, John_Doe, and
Helen_Jonson. When you continue to type letters, search results are narrowed to match the exact
pattern. For this example, when you type John_, search returns John_Smith and John_Doe.

VMware, Inc. 12
Administering vRealize Log Insight

You can sort search results by fields: domain, authentication, roles, email, or UPN. In addition, you can
perform a bulk action, such as deleting multiple users, on the search result.

Create a New User Account in vRealize Log Insight

Users that are given the Super Admin role can create user accounts to provide access to the vRealize
Log Insight web user interface.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Verify that you have configured VMware Identity Manager or Active Directory support if you are creating
user accounts that use either of these types of authentication. See Enable User Authentication Through
VMware Identity Manager and Enable User Authentication Through Active Directory

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Access Control.

3 Click Users/Users and Groups.

4 Click New User.

5 Select an item from the Authentication drop-down menu.

n If you are using the default, built-in authentication, enter a user name, password, and, optionally,
an email address. Copy the password from the Password text box and provide it to the user.

n If you are using Active Directory or VMware Identity Manager authentication, enter the domain to
which the user belongs, a user name, and optionally, the email address for the user name
account.

6 From the Roles list on the right, select one or more predefined or custom user roles.

Option Description

User Users can access the full functionality of vRealize Log Insight. You can view log
events, run queries to search and filter logs, import content packs into their own
user space, add alert queries, and manage your own user accounts to change a
password or email address. Users do not have access to the administration
options, cannot share content with other users, cannot modify the accounts of other
users, and cannot install a content pack from the Marketplace. However, you can
import a content pack into your own user space which is visible only to you.

Dashboard User Dashboard users can only use the Dashboards page of vRealize Log Insight.

VMware, Inc. 13
Administering vRealize Log Insight

Option Description

View Only Admin View Admin users can view Admin information, have full User access, and can edit
Shared content.

Super Admin Super Admin users can access the full functionality of vRealize Log Insight, can
administer vRealize Log Insight, and can manage the accounts of all other users.

7 Click Save.

n For built-in authentication, the information is saved locally.

n For authentication with VMware Identity Manager, vRealize Log Insight verifies whether VMware
Identity Manager is synchronized with the specified group and its domain. If the group cannot be
found, a dialog box informs you that vRealize Log Insight cannot verify that group. You can save
the group without verification or cancel to correct the group name or domain.

Configure VMware Identity Manager Access to Active

Directory Groups for vRealize Log Insight
You can use Active Directory groups with vRealize Log Insight through VMware Identity Manager single
sign-on authentication. Your site must be configured for VMware Identity Manager authentication that is
enabled for Active Directory support, and server synchronization must be in place.

You must also import group information to vRealize Log Insight

A VMware Identity Manager user inherits roles that are assigned to any group the user belongs to in
addition to the roles that are assigned to the individual user. For example, an Administrator can assign
GroupA to the role of View Admin and assign the user Bob to the role of User. Bob can also be assigned
to GroupA. When Bob logs in, he inherits the group role and has privileges for both the View Admin and
User roles.

The group is not a VMware Identity Manager local group, but an Active Directory group that is
synchronized with VMware Identity Manager.

Prerequisites

n Verify that you have configured the UPN attribute (userPrincipalName) attribute. It can be configured
through the VMware Identity Manager administrator interface at Identity & Access Management >
User Attributes.

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is
the IP address or host name of the vRealize Log Insight virtual appliance.

n Verify that you configured VMware Identity Manager support in vRealize Log Insight. See Enable
User Authentication Through VMware Identity Manager

Procedure

1 Click the configuration drop-down menu icon and select Administration.

VMware, Inc. 14
Administering vRealize Log Insight

2 Under Management, click Access Control.

3 Click Users and Groups.

4 Scroll to the Directory Groups table and click New Group.

5 Select VMware Identity Manager from the Type drop-down menu.

The default domain name that you specified when you configured VMware Identity Manager support
appears in the Domain text box.

6 Change the domain name to the Active Directory name for the group.

7 Enter the name of the group that you want to add.

8 From the Roles list on the right, select one or more predefined or custom user roles.

Option Description

User Users can access the full functionality of vRealize Log Insight. You can view log
events, run queries to search and filter logs, import content packs into their own
user space, add alert queries, and manage your own user accounts to change a
password or email address. Users do not have access to the administration
options, cannot share content with other users, cannot modify the accounts of other
users, and cannot install a content pack from the Marketplace. However, you can
import a content pack into your own user space which is visible only to you.

Dashboard User Dashboard users can only use the Dashboards page of vRealize Log Insight.

View Only Admin View Admin users can view Admin information, have full User access, and can edit
Shared content.

Super Admin Super Admin users can access the full functionality of vRealize Log Insight, can
administer vRealize Log Insight, and can manage the accounts of all other users.

9 Click Save.

vRealize Log Insight verifies whether VMware Identity Manager is synchronized with the specified
group and its domain. If the group cannot be found, a dialog box informs you that vRealize Log
Insight cannot verify that group. You can save the group without verification or cancel to correct the
group name or domain.

Results

Users that belong to the group that you added can use their VMware Identity Manager account to log in to
vRealize Log Insight and have the same level of permissions as the group to which they belong.

Import an Active Directory Group to vRealize Log Insight

Instead of adding individual domain users, you can add domain groups to allow users to log in to vRealize
Log Insight.

When you enable AD support in vRealize Log Insight, you configure a domain name and provide a
binding user that belongs to the domain. vRealize Log Insight uses the binding user to verify the
connection to the AD domain, and to verify the existence of AD users and groups.

VMware, Inc. 15
Administering vRealize Log Insight

The Active Director groups that you add to vRealize Log Insight must either belong to the domain of the
binding user, or to a domain that is trusted by the domain of the binding user.

An Active Directory user inherits roles that are assigned to any group the user belongs to in addition to
the roles that are assigned to the individual user. For example, an Administrator can assign GroupA to the
role of View Admin and assign the user Bob to the role of User. Bob can also be assigned to GroupA.
When Bob logs in, he inherits the group role and has privileges for both the View Admin and User roles.

Prerequisites

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is
the IP address or host name of the vRealize Log Insight virtual appliance.

n Verify that you configured AD support. See Enable User Authentication Through Active Directory

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Access Control.

3 Click Users and Groups.

4 Under Directory Groups, click New Group.

5 Click Active Directory in the Type drop-down menu.

The default domain name that you specified when you configured Active Directory support appears in
the Domain text box. If you are adding groups from the default domain, do not modify the domain
name.

6 (Optional) If you want to add a group from a domain that trusts the default domain, type the name of
the trusting domain in the Domain text box.

7 Enter the name of the group that you want to add.

8 From the Roles list on the right, select one or more predefined or custom user roles.

Option Description

User Users can access the full functionality of vRealize Log Insight. You can view log
events, run queries to search and filter logs, import content packs into their own
user space, add alert queries, and manage your own user accounts to change a
password or email address. Users do not have access to the administration
options, cannot share content with other users, cannot modify the accounts of other
users, and cannot install a content pack from the Marketplace. However, you can
import a content pack into your own user space which is visible only to you.

Dashboard User Dashboard users can only use the Dashboards page of vRealize Log Insight.

View Only Admin View Admin users can view Admin information, have full User access, and can edit
Shared content.

Super Admin Super Admin users can access the full functionality of vRealize Log Insight, can
administer vRealize Log Insight, and can manage the accounts of all other users.

VMware, Inc. 16
Administering vRealize Log Insight

9 Click Save.

vRealize Log Insight verifies whether the AD group exists in the domain that you specified or in a
trusting domain. If the group cannot be found, a dialog box informs you that vRealize Log Insight
cannot verify that group. You can save the group without verification or cancel to correct the group
name.

Results

Users that belong to the Active Directory group that you added can use their domain account to log in to
vRealize Log Insight and have the same level of permissions as the group to which they belong.

Authenticating Users with Cross-Domain Group

Membership
There are two ways that administrators can enable users from another trusted domain to authenticate for
vRealize Log Insight.

n Add each user manually.

n Configure a group in the same domain as the users and add the group.

Define a Data Set

You can define a data set to provide users access to specific content.

Text-based constraints are not supported for data sets.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Access Control.

3 Click Data Sets.

4 Click New Data Set.

5 Click Add Filter.

6 Use the first drop-down menu to select a field defined within vRealize Log Insight to filter on.

For example, hostname.

VMware, Inc. 17
Administering vRealize Log Insight

The list contains static fields only and excludes fields that are extracted, user shared, and text fields,
and fields created through event_type filters.

Note Numeric fields contain the additional operators =, >, <, >=, and <=, which string fields do not.
These operators perform numeric comparisons. Using them yields different results than using string
operators. For example, the filter response_time = 02 matches an event that contains a
response_time field with a value 2. The filter response_time contains 02 does not have the same
match.

7 Use the second drop-down menu to select the operation to apply to the field selected in the first drop-
down menu.

For example, select contains. The contains filter matches full tokens: searching for the string err
does not result in error as a match.

8 In the filter box to the right of the filter drop-down menu, enter the value that you want to use as a
filter.

You can use multiple values. The operator between these values is OR.

Note The box is not available if you select the exists operator in the second drop-down menu.

9 (Optional) To add more filters, click Add Filter.

10 (Optional) To verify that the filter behavior is what you want, click Run in Interactive Analytics, which
opens an interactive analytics window with data that matches your filters.

11 Click Save.

What to do next

Associate a data set with a user role. See Create and Modify Roles.

Create and Modify Roles

You can create custom roles or modify predefined roles to allow users to perform certain tasks and
access specific content.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Access Control.

3 Click Roles.

VMware, Inc. 18
Administering vRealize Log Insight

4 Click New Role or to edit an existing role.

You must clone Super Admin and User roles first before you can edit them.

5 Modify the Name and Description text boxes.

6 Select one or more permissions from the Permissions list.

Option Description

Edit Admin Can edit Admin information and settings

View Admin Can view Admin information and settings

Edit Shared Can edit shared content

Analytics Can use Interactive Analytics

Dashboard Can view Dashboards

7 (Optional) From the Data Sets list on the right, select a data set to associate with the user role.

8 Click Save.

Delete a User Account or Group from vRealize Log Insight

You can delete user accounts or groups from the vRealize Log Insight Administration user interface.

User accounts and groups are listed in separate tables on the Access Control page. You can use a
search filter to find specific user accounts. When you delete a group, all users that belong to the group
lose the privileges given to them by the group.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Access Control.

3 Click Users and Groups.

4 Select the check box beside the user name or group that you want to delete.

5 To remove the account or group, click X DELETE at the top of the User Account or Groups table.

VMware, Inc. 19
 3
Configuring Authentication

You can use several authentication methods with your deployment.

Authentication methods include local authentication, VMware Identity Manager authentication, and Active
Directory authentication. You can use more than one method in the same deployment and users then
select the type of authentication to use at login.

The download page for vRealize Log Insight includes a download link for the appropriate version of
VMware Identity Manager. VMware Identity Manager includes the following features.

n Directory integration to authenticate users against existing directories such as Active Directory or
LDAP.

n Single Sign-On integration with other VMware products that also support Single Sign-On capability.

n Single Sign-On with several third-party identity providers such as ADFS, Ping Federate, and others.

n Two-factor authentication through integration with third-party software such as RSA SecurID, Entrust,
and others. Two-factor authentication with VMware Verify is included.

Local authentication is a component of vRealize Log Insight. To use it, you create a local user and
password that is stored on the vRealize Log Insight server. A product administrator must enable vRealize
Log Insight and Active Directory.

This chapter includes the following topics:

n Enable User Authentication Through VMware Identity Manager

n Enable User Authentication Through Active Directory

Enable User Authentication Through VMware Identity

Manager
When enabled by an administrator, VMware Identity Manager authentication can be used with vRealize
Log Insight.

With VMware Identity Manager authentication, users can use a single sign-on for all VMware products
that use the same Identity Manager.

VMware, Inc. 20
Administering vRealize Log Insight

Active Directory users can also authenticate through VMware Identity Manager when the Active Directory
and VMware Identity Manager servers are synchronized. See VMware Identity Manager documentation
for more information about synchronization.

Integration with VMware Identity Manager can be done only with local users. Active Directory users who
are assigned a tenant admin role in VMware Identity Manager are not eligible for integration with vRealize
Log Insight.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click Authentication.

3 Select Enable Single Sign-On.

4 In the Host text box, enter a host identifier for the VMware Identity Manager instance to use for
authenticating users .

For example, [Link].

5 In the API Port text box, specify the port to use to connect to the VMware Identity Manager instance.
The default is 443.

6 Optionally, enter the VMware Identity Manager tenant. This is required only if tenant mode is
configured as tenant-in-path in VMware Identity Manager.

7 Specify VMware Identity Manager user credentials in the Username and Password text boxes.

This information is used only once during configuration for creating a vRealize Log Insight client
onVMware Identity Managerand is not stored locally in vRealize Log Insight. The user must have
permission to run API commands against the tenant.

8 Click Test Connection to verify that the connection works.

9 In the Redirect URL Host drop-down menu, select the Hostname or IP to be used in Redirect URL
for registering on VMware Identity Manager.

If at least one virtual IP is defined for the Integrated Load Balancer,VMware Identity Manager
redirects to the VIP selected. If the Integrated Load Balancer is not configured, the master node's IP
address is used instead.

10 Select whether to allow log in support for Active Directory users through VMware Identity Manager.

You can use this option for Active Directory users when VMware Identity Manager is synchronized
with that Active Directory instance.

11 Click Save.

VMware, Inc. 21
Administering vRealize Log Insight

Enable User Authentication Through Active Directory

You can authenticate users through Active Directory to simplify the log in process by letting users use a
common password for multiple purposes.

Child domain access is not supported through Active Directory. This type of access is supported through
VMware Identity Manager only.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click Authentication.

3 Select Enable Active Directory support.

4 In the Default Domain text box, type a domain name.

For example, [Link].

Note You cannot list multiple domains in the default domain text box. If the default domain that you
specify is trusted by other domains, vRealize Log Insight uses the default domain and the binding
user to verify AD users and groups in the trusting domains. Child-domain access with AD is
unsupported.

If you switch to a different domain that already includes users and groups, the authentication fails for
the existing users and groups, and data saved by the existing users is lost.

5 If you have geo-located or security-restricted domain controllers, manually specify the domain
controllers closest to this vRealize Log Insight instance.

Note Load-balanced Active Directory authorization servers are not supported.

6 Enter the credentials of a binding user that belongs to the default domain.

vRealize Log Insight uses the default domain and the binding user to verify AD users and groups in
the default domain, and in domains that trust the default domain.

7 Specify values for the connection type.

This connection is used for Active Directory authentication.

8 Click Save.

What to do next

Give permissions to AD users and groups to access the current instance of vRealize Log Insight.

VMware, Inc. 22
Administering vRealize Log Insight

Configure the Protocol to Use for Active Directory

You can configure the protocol to use when connecting to Active Directory. By default, when vRealize Log
Insight connects to Active Directory, it first tries SSL LDAP, and then non-SSL LDAP if necessary.

If you want to limit the Active Directory communication to one particular protocol, or want to change the
order of protocols that are tried, you must apply additional configurations in the vRealize Log Insight
virtual appliance.

Prerequisites

n Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

n To enable SSH connections, verify that TCP port 22 is open.

Procedure

1 Establish an SSH connection to the vRealize Log Insight virtual appliance and log in as the root user.

2 Navigate to the following location: /storage/core/loginsight/config

3 Locate the latest configuration file where [number] is the largest: /storage/core/loginsight/
config/[Link]#[number]

4 Copy the latest configuration file: /storage/core/loginsight/config/loginsight-

[Link]#[number]

5 Increase the [number] and save to the following location: /storage/core/loginsight/config/

[Link]#[number + 1]

6 Open the file for editing.

7 In the Authentication section, add the line that corresponds to the configuration that you want to
apply:

Option Description

<ad-protocols value="LDAP" /> For specifically using LDAP without SSL

<ad-protocols value="LDAPS" /> For specifically using LDAP with SSL only

<ad-protocols value="LDAP,LDAPS" /> For specifically using LDAP first and then using LDAP with SSL.

<ad-protocols value="LDAPS,LDAP" /> For specifically using LDAPS first and then using LDAP without SSL

When you do not select a protocol, vRealize Log Insight attempts to use LDAP first, and then uses
LDAP with SSL.

8 Save and close the file.

9 Run the service loginsight restart command.

VMware, Inc. 23
 4
Configuring vRealize Log Insight

You can configure and customize vRealize Log Insight to change default settings, network settings, and
modify storage resources. You can also configure system notifications.

This chapter includes the following topics:

n vRealize Log Insight Configuration Limits

n Configure Data Retention

n Configuring Virtual Appliance Settings

n Assign a License to vRealize Log Insight

n Log Storage Policy

n Managing System Notifications

n Add a vRealize Log Insight Event Forwarding Destination

n Synchronize the Time on the vRealize Log Insight Virtual Appliance

n Configure the SMTP Server for vRealize Log Insight

n Install a Custom SSL Certificate

n Change the Default Timeout Period for vRealize Log Insight Web Sessions

n Archiving

n Restart the vRealize Log Insight Service

n Power Off the vRealize Log Insight Virtual Appliance

n Download a vRealize Log Insight Support Bundle

n Join or Leave the VMware Customer Experience Improvement Program

vRealize Log Insight Configuration Limits

When you configure vRealize Log Insight, you must stay at or below the supported maximums.

VMware, Inc. 24
Administering vRealize Log Insight

Table 4-1. vRealize Log Insight Configuration Maximums

Item Maximum

Node Configuration

CPU 16vCPUs

Memory 32 GB

Storage device (vmdk) 2TB - 512 bytes

Total addressable storage 4 TB (+ OS drive)

A maximum of 4TB addressable log storage on VMDKs with a maximum size of
2TB each. You can have two 2TB VMDKs or four 1TB VMDKs, etc. When you
reach the maximum, you will need to scale outward with a larger cluster size
instead of adding more disks to existing VMs.

Syslog connections 750

Cluster Configuration

Nodes 12 (Master + 11 Workers)

Ingestion per Node

Events per second 15,000 eps

Syslog message length 10 KB (text field)

Ingestion API HTTP POST request 16 KB (text field); 4 MB per HTTP Post request

Integrations

vRealize Operations Manager 1

vSphere vCenter Server 15 per node

Active Directory domains 1

Email servers 1

DNS servers 2

NTP servers 4

Forwarders 10

Configure Data Retention

You can enable the ability to remove data older than a certain date or time period by configuring the data
retention functionality. Data retention is disabled by default.

Prerequisites

Verify that you are logged into the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 From the web user interface, click the configuration drop-down menu icon and select Administration.

VMware, Inc. 25
Administering vRealize Log Insight

2 Under Configuration, click General.

3 Check the Data Retention check box and specify the retention period to enable the data retention
functionality.

Note
n The default data retention period is 12 months, where one month is equal to 30 days.

n The retention period applies only to the storage of nodes, leaving the NFS archive intact.

4 Click Save.

Results

Once enabled, data retention initiates in one hour and checks data for removal once a day.

Note If the ingestion rate is slow, there might be a slight difference between the configured retention
period and the timestamp of the oldest data in the cluster.

Configuring Virtual Appliance Settings

You can modify virtual appliance settings, including storage capacity and memory or CPU capacity.

Configure the Root SSH Password for the vRealize Log Insight
Virtual Appliance
By default the SSH connection to the virtual appliance is disabled. You can configure the root SSH
password from the VMware Remote Console or when you deploy the vRealize Log Insight virtual
appliance.

As a best practice, set the root SSH password when you deploy thevRealize Log Insight .ova file. For
more information, see Deploy the vRealize Log Insight Virtual Appliance.

You can also enable SSH and set the root password from the VMware Remote Console.

Prerequisites

Verify that the vRealize Log Insight virtual appliance is deployed and running.

Procedure

1 In the vSphere Client inventory, click the vRealize Log Insight virtual appliance, and open the
Console tab.

2 Go to a command line by following the key combination specified on the splash screen.

3 In the console, type root, and press Enter. Leave the password empty and press Enter.

The following message is displayed in the console: Password change requested. Choose a new
password.

4 Leave the old password empty and press Enter.

VMware, Inc. 26
Administering vRealize Log Insight

5 Type a new password for the root user, press Enter, type the new password again for the root user,
and press Enter.

The password must consist of at least eight characters, and must include at least one upper case
letter, one lower case letter, one digit, and one special character. You cannot repeat the same
character more than four times.

Results

The following message is displayed: Password changed.

What to do next

You can use the root password to establish SSH connections to the vRealize Log Insight virtual
appliance.

Change the Network Settings of the vRealize Log Insight Virtual

Appliance
You can change the network settings of the vRealize Log Insight virtual appliance by editing the vApp
properties in the vSphere Client.

For more information on configuring vApps, see [Link]

Prerequisites

Verify that you have permissions to edit vApp properties.

Procedure

1 Power off the vRealize Log Insight virtual appliance.

2 Right-click the vRealize Log Insight virtual appliance in the inventory and click Edit Settings.

3 Click the Options tab and select vApp Options > IP Allocation Policy.

4 Select an IP allocation option.

Option Description

Fixed IP addresses are manually configured. No automatic allocation is performed.

Transient IP addresses are automatically allocated using IP pools from a specified range
when the vApp is powered on. The IP addresses are released when the appliance
is powered off

DHCP A DHCP server is used to allocate the IP addresses. The addresses assigned by
the DHCP server are visible in the OVF environments of virtual machines started in
the vApp.

VMware, Inc. 27
Administering vRealize Log Insight

5 (Optional) If you select Fixed, click vApp Options > Properties and assign an IP address, netmask,
gateway, DNS and host name for the vRealize Log Insight vApp.

Caution Do not specify more than two domain name servers. If you specify more than two domain
name servers, all configured domain name servers are ignored in the vRealize Log Insight virtual
appliance.

6 Power on the vRealize Log Insight vApp.

Increase the Storage Capacity of the vRealize Log Insight Virtual

Appliance
You can increase the storage resources allocated to vRealize Log Insight as your needs grow.

Increase the storage space by adding a new virtual disk to the vRealize Log Insight virtual appliance. You
can add as many disks as you need, up to 4 TB (+ OS drive) total addressable storage. The total can be
a combination of two 2-TB disks, or four 1-TB disks, and so on. See vRealize Log Insight Configuration
Limits.

In a vRealize Log Insight cluster, you must add the same amount of storage to each node in the cluster.

Prerequisites

n Log in to the vSphere Client as a user who has privileges to modify the hardware of virtual machines
in the environment.

n Shut down the vRealize Log Insight virtual appliance safely. See Power Off the vRealize Log Insight
Virtual Appliance

Procedure

1 In the vSphere Client inventory, right-click the vRealize Log Insight virtual machine and select Edit
Settings.

2 On the Hardware tab, click Add.

3 Select Hard Disk and click Next.

VMware, Inc. 28
Administering vRealize Log Insight

4 Select Create a new virtual disk and click Next.

a Type the disk capacity.

vRealize Log Insight supports virtual hard disks of up to 2 TB. If you need more capacity, add
more than one virtual hard disk.

b Select a disk format.

Option Description

Thick Provision Lazy Zeroed Creates a virtual disk in the default thick format. The space required for the
virtual disk is allocated when the virtual disk is created. The data residing on the
physical device is not erased during creation, but is zeroed out on demand later,
after first write from the virtual appliance.

Thick Provision Eager Zeroed Creates a type of thick virtual disk that supports clustering features such as
Fault Tolerance. The space required for the virtual disk is allocated at creation
time. In contrast to the flat format, the data residing on the physical device is
zeroed out when the virtual disk is created. It might take much longer to create
disks in this format than to create other types of disks.
Create thick provisioned eager zeroed disks whenever possible for better
performance and operation of the vRealize Log Insight virtual appliance.

Thin Provision Creates a disk in thin format. Use this format to save storage space.

c (Required) To select a datastore, browse for the datastore location and click Next.

5 Accept the default virtual device node and click Next.

6 Review the information and click Finish.

7 Click OK to save your changes and close the dialog box.

Results

When you power on the vRealize Log Insight virtual appliance, the virtual machine discovers the new
virtual disk and automatically adds it to the default data volume. Completely power off the virtual machine
first. For information about powering on virtual appliances, see [Link]
[Link].

Caution After you add a disk to the virtual appliance, you cannot remove it safely. Removing disks from
the vRealize Log Insight virtual appliance may result in complete data loss.

Add Memory and CPU to the vRealize Log Insight Virtual

Appliance
You can change the amount of memory and CPUs allocated to a vRealize Log Insight virtual appliance
after deployment.

You might need to adjust resource allocation if, for example, the number of events in your environment
increases.

VMware, Inc. 29
Administering vRealize Log Insight

Prerequisites

n Log in to the vSphere Client as a user who has privileges to modify the hardware of virtual machines
in the environment.

n Shut down the vRealize Log Insight virtual appliance safely. See Power Off the vRealize Log Insight
Virtual Appliance

Procedure

1 In the vSphere Client inventory, right-click the vRealize Log Insight virtual machine and select Edit
Settings.

2 On the Hardware tab, click Add.

3 Adjust the amount of CPU and memory as needed.

4 Review the information and click Finish.

5 Click OK to save your changes and close the dialog box.

Results

When you power on the vRealize Log Insight virtual appliance, the virtual machine begins to utilize the
new resources.

Assign a License to vRealize Log Insight

You can use vRealize Log Insight only with a valid license key.

You obtain an evaluation license when you download vRealize Log Insight from the VMware website. This
license is valid for 60 days. When the evaluation license expires, you must assign a permanent license to
continue using vRealize Log Insight.

The vRealize Log Insight Operating System Instance (OSI) license model defines an OSI as a single
installation of an operating system on a non-virtualized physical server or virtual machine. For vRealize
Log Insight, an OSI can also be a single system identified by an IP address such as virtualized physical
servers, storage arrays, or network devices that can generate log messages.

When a host, server or other source stops sending logs to vRealize Log Insight, the OSI count on the
License page is unchanged during the retention period. The retention period is based on license use
calculated as the average of the OSI count over the last three months.

You use the Administration section of the vRealize Log Insight web user interface to check the vRealize
Log Insight licensing status and manage your licenses.

As part of solution interoperability, VMware NSX users on Standard, Advanced, or Enterprise editions can
license vRealize Log Insight with their NSX license key. For more information, consult VMware NSX
documentation.

Prerequisites

n Obtain a valid license key from My VMware™.

VMware, Inc. 30
Administering vRealize Log Insight

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, select License.

3 In the License Key text box, enter your license key and click Set Key. If you have a VMware NSX
license key, enter it here.

4 Verify that the license status is Active, and the license type and expiry day are correct.

Log Storage Policy

The vRealize Log Insight virtual appliance uses a minimum of 100 GB of storage for incoming logs.

When the volume of logs imported into vRealize Log Insight reaches the storage limit, old log messages
are automatically and periodically retired on a first-come-first-retired basis. You can increase the storage
limit by adding more storage to the vRealize Log Insight virtual appliance. See Increase the Storage
Capacity of the vRealize Log Insight Virtual Appliance.

To preserve old messages, you can enable the archiving feature of vRealize Log Insight. See Enable or
Disable Data Archiving in vRealize Log Insight.

Data stored by vRealize Log Insight is immutable. After a log has been imported, it cannot be removed
until it is automatically retired.

Managing System Notifications

vRealize Log Insight provides built-in system notifications about activity related to vRealize Log Insight
health, such as when disk space is almost exhausted and old log files are about to be deleted.
Administrators can configure how often and where system notifications are sent.

System notifications inform you of critical issues that require immediate attention, provide you with
warnings that might require a response, and inform you of normal system activity. System notifications are
suspended during upgrade, but in effect at all other times.

An administrator can specify how often notifications are sent when triggered and to which email
addresses. System notifications concerning vRealize Log Insight can also be sent to third-party
applications.

System notifications are distinct from alert queries, which are user-defined. For more information about
alert queries, see Add an Alert Query in Log Insight to Send Email Notifications.

VMware, Inc. 31
Administering vRealize Log Insight

vRealize Log Insight System Notifications

vRealize Log Insight provides you with two sets of notifications about system health, general notifications,
applicable for all product configurations, and notifications related to clusters for cluster-based
deployments.

The following tables list and describe system notifications for vRealize Log Insight.

General System Notifications

vRealize Log Insight issues notifications about conditions that might require administrative intervention,
including archival failure or alert scheduling delays.

Notification Name Description

Oldest Data Will Be Unsearchable Soon vRealize Log Insight is expected to start decommissioning old data from
the virtual appliance storage based on the expected size of searchable
data, storage space, and the current ingestion rate. Data that has been
rotated out is archived if you have configured archiving, or deleted if you
have not.
To address this, add storage or adjust the retention notification threshold.
For more information, see Configure vRealize Log Insight to Send Health
Notifications.
The notification is sent after each restart of the vRealize Log Insight
service.

Repository Retention Time A retention period is the length of time data is retained on the local disk of
your vRealize Log Insight instance. A retention period is determined by the
amount of data the system can hold and the current ingestion rate. For
example, if you are receiving 10 GB/day of data (after indexing) and you
have 300 GB of space, then your retention rate is 30 days.
When your storage limit is reached, old data is removed to make way for
newly ingested data. This notification tells you when the amount of
searchable data that vRealize Log Insight can store at the current ingestion
rates exceeds the storage space that is available on the virtual appliance.
You could run out of storage before the time period set with the Retention
Notification Threshold. Add storage or adjust the retention notification
threshold.

Dropped Events vRealize Log Insight failed to ingest all incoming log messages.
n In case of a TCP Message drops, as tracked by vRealize Log Insight
server, a system notification is sent as follows:
n Once a day
n Each time the vRealize Log Insight service is restarted, manually
or automatically
n The email contains the number of messages dropped since last
notification email was sent and total message drops since the last
restart of vRealize Log Insight.
Note that the time in the sent line is controlled by the email client, and is in
the local time zone, while the email body displays UTC time.

VMware, Inc. 32
Administering vRealize Log Insight

Notification Name Description

Corrupt Index Buckets Part of the on-disk index is corrupt. A corrupt index usually indicates
serious issues with the underlying storage system. The corrupt part of the
index is excluded from serving queries. A corrupt index affects the
ingestion of new data. vRealize Log Insight checks the integrity of the
index upon service start-up. In case of detected corruption, vRealize Log
Insight sends a system notification as follows:
n Once a day
n Each time the vRealize Log Insight service is restarted, manually or
automatically

Out of Disk vRealize Log Insight is running out of allocated disk space. vRealize Log
Insight has most probably run into a storage-related issue.

Archive Space Will Be Full The disk space on the NFS server used for archiving vRealize Log Insight
data will be used up soon.

Total Disk Space Change The total size of the partition for vRealize Log Insight data storage has
decreased. This usually signals a serious issue in the underlying storage
system. When vRealize Log Insight detects the condition it sends this
notification as follows:
n Immediately
n Once a day

Pending Archivings vRealize Log Insight cannot archive data as expected. The notification
usually indicates problems with the NFS storage that you configured for
data archiving.

License is about to be expired The license for vRealize Log Insight is about to expire.

License is expired The license for vRealize Log Insight has expired.

Unable to connect to AD server vRealize Log Insight is unable to connect to the configured Active Directory
server.

Cannot take over High Availability IP address [IP The vRealize Log Insight cluster was unable to take over the configured IP
Address] as it is already held by another machine Address for the Integrated Load Balancer (ILB). The most common reason
for this notification is that another host within the same network holds the
IP address, and therefore the IP address is not available to be taken over
by the cluster.
You can resolve this conflict by either releasing the IP address from the
host that currently holds it, or configuring Log Insight Integrated Load
Balancer with a Static IP address that is available in the network. When
changing the ILB IP address, remember to reconfigure all clients to send
logs to the new IP address, or to a FQDN/URL that resolves to this IP
address. You must also unconfigure and reconfigure every vCenter Server
integrated with vRealize Log Insight from the vSphere integration page.

VMware, Inc. 33
Administering vRealize Log Insight

Notification Name Description

High Availability IP address [IP Address] is The IP Address configured for the Integrated Load Balancer (ILB) is
unavailable due to too many node failures unavailable. This means that clients trying to send logs to a vRealize Log
Insight cluster via the ILB IP address or a FQDN/URL that resolves to this
IP address will see it as unavailable. The most common reason for this
notification is that a majority of the nodes in the vRealize Log Insight
cluster are unhealthy, unavailable, or unreachable from the master node.
Another common reason is that NTP time synchronization has not been
enabled, or the configured NTP servers have significant time drift between
each other. You can confirm that the problem is still ongoing by trying to
ping (if allowed) the IP address to verify that it is not reachable.
You can resolve this problem by ensuring a majority of your cluster nodes
are healthy and reachable, and enabling NTP time synchronization to
accurate NTP servers.

Too many migrations of High Availability IP address The IP address configured for the Integrated Load Balancer (ILB) has
[your IP Address] between vRealize Log Insight nodes migrated too many times within the last 10 minutes.
Under normal operation, the IP address rarely moves between vRealize
Log Insight cluster nodes. However, the IP address might move if the
current owner node is restarted or put in maintenance. The other reason
can be lack of time synchronization between Log Insight cluster nodes,
which is essential for proper cluster functioning. In case of latter, you can
fix the problem by enabling NTP time synchronization to accurate NTP
servers.

SSL Certificate Error A syslog source has initiated a connection to vRealize Log Insight over
SSL but ended the connection abruptly. This may indicate that the syslog
source was unable to confirm the validity of the SSL certificate. In order for
vRealize Log Insight to accept syslog messages over SSL, a certificate
that is validated by the client is required and the clocks of the systems
must be synchronized. There may be an issue with the SSL Certificate or
with the Network Time Service.
You can validate that the SSL Certificate is trusted by your syslog source,
reconfigure the source not to use SSL, or reinstall the SSL Certificate. See
Configure the vRealize Log Insight Agent SSL Parameters and Install a
Custom SSL Certificate.

vCenter collection failed vRealize Log Insight is unable to collect vCenter events, tasks, and alarms.
To look for the exact error that caused the collection failure and to see if
collection is working currently, look in the /storage/var/loginsight/
plugins/vsphere/[Link] file.

Event Forwarder Events Dropped A forwarder drops events because of connection or overload issues.
Example:

Log Insight Admin Alert: Event Forwarder Events Dropped

This alert is about your Log Insight installation on
[Link]

Event Forwarder Events Dropped triggered at

2016-08-02T18:41:06.972Z

Log Insight just dropped 670 events for forwarder target

'Test',
reason: Pending queue is full.

VMware, Inc. 34
Administering vRealize Log Insight

Notification Name Description

Alert Queries Behind Schedule vRealize Log Insight was unable to run a user-defined alert at its
configured time. The reason for the delay may be because of one or more
inefficient user-defined alerts or because the system is not properly sized
for the ingestion and query load.

Auto Disabled Alert If a user-defined alert has run at least ten times and its average run time is
more than one hour, then the alert is deemed to be inefficient and is
disabled to prevent impacting other user-defined alerts.

Inefficient Alert Query If a user-defined alert takes more than one hour to complete, then the alert
is deemed to be inefficient.

System Notifications for Clusters

vRealize Log Insight sends notifications about cluster topology changes, including the addition of new
cluster members or transient node communication problems.

Sent by Notification Name Description

Master node Approval needed for new worker node A worker node is sending a request to join
a cluster. An Admin user needs to approve
or reject the request.

Master node New worker node approved An Admin user approved a membership
request from a worker node to join a
vRealize Log Insight cluster.

Master node New worker node denied An Admin user rejected a membership
request from a worker node to join a
vRealize Log Insight cluster. If the request
was denied by mistake, an Admin user
can place the request again from the
worker and then approve it at the master
node.

Master node Maximum supported nodes exceeded The number of worker nodes in the Log
due to worker node Insight cluster has exceeded the
maximum supported count due to a new
worker node.

Master node Allowed nodes exceeded, new worker An Admin user attempted to add more
node denied nodes to the cluster than the maximum
allowed node count and the node has
been denied.

Master node Worker node disconnected A previously connected worker node

disconnected from the vRealize Log
Insight cluster.

Master node Worker node reconnected A worker node reconnected to the

vRealize Log Insight cluster.

Master node Worker node revoked by admin An Admin user revoked a worker node
membership and the node is no longer a
part of the vRealize Log Insight cluster.

VMware, Inc. 35
Administering vRealize Log Insight

Sent by Notification Name Description

Master node Unknown worker node rejected The vRealize Log Insight master node
rejected a request by a worker node
because the worker node is unknown to
the master. If the worker is a valid node
and it should be added to the cluster, log
in to the worker node, remove its token file
and user configuration at /storage/
core/loginsight/config/, and run
restart loginsight service on the
worker node.

Master node Worker node has entered into A worker node entered into maintenance
maintenance mode mode and an Admin user has to remove
the worker node from maintenance mode
before it can receive configuration
changes and serve queries.

Master node Worker node has returned to service A worker node exited maintenance mode
and returned to service.

Worker node Master failed or disconnected from The worker node that sends the
worker node notification is unable to contact the
vRealize Log Insight master node. This
might indicate that the master node failed,
and might need to be restarted. If the
master node failed, the cluster cannot be
configured and queries cannot be
submitted until it is back online. Worker
nodes continue to ingest messages.

Note You might receive many such

notifications because many workers might
detect the master node failure
independently and raise notifications.

Worker node Master connected to worker node The worker node that sends the
notification is reconnected to the vRealize
Log Insight master node.

Configuring Destinations for vRealize Log Insight System

Notifications
As an administrator user, you can configure the action vRealize Log Insight takes when a system
notification is triggered.

vRealize Log Insight generates system notifications when an important system event occurs, for example
when the disk space is almost exhausted and vRealize Log Insight must begin deleting or archiving old
log files.

Administrators can configure vRealize Log Insight to send email notifications about these events. The
from address of system notification emails is configured by the administrator user on the SMTP
configuration page of the Administration UI, in the Sender text box. See Configure the SMTP Server for
vRealize Log Insight.

VMware, Inc. 36
Administering vRealize Log Insight

Administrator users can also send notifications to third-party applications. See About Using Webhooks to
Send System Notifications to Third-Party Products.

Configure vRealize Log Insight to Send Health Notifications

An administrator can configure vRealize Log Insight to send notifications related to its own health.

If an email message cannot be delivered, you are notified of the error on the Web interface.

Prerequisites

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

n Verify that the SMTP server is configured for vRealize Log Insight. For more information, see
Configure the SMTP Server for vRealize Log Insight.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click General.

3 Under the Alerts header, set the system notifications.

a In the Email System Notifications To text box, type the email addresses to be notified.

Use commas to separate multiple email addresses.

b Select the Retention notification threshold check box and set the threshold that triggers the
notifications.

A notification is sent when the amount of data the system can hold is insufficient for the time
period specified. This value is calculated based on the current ingestion rate.

4 Click Save.

5 Click Restart Log Insight to apply your changes.

Configure vRealize Log Insight System Notifications for Third-Party Products

An administrator can configure vRealize Log Insight to send notifications related to its own health to third-
party applications.

vRealize Log Insight generates these notifications when an important system event occurs, for example
when the disk space is almost exhausted and vRealize Log Insight must start deleting old log files.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

VMware, Inc. 37
Administering vRealize Log Insight

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click General.

3 Under the Alerts header, set the system notifications.

a In the Send HTTP Post System Notifications To text box, type the URLs to be notified.

b (Optional) Confirm that the Send a notification when capacity drops below check box and
associated threshold are configured correctly for your environment.

4 Click Save.

What to do next

Working with the webhook output for your notification, create a shim to map the vRealize Log Insight
webhook format to the format used by your third-party application.

About Using Webhooks to Send System Notifications to Third-Party Products

You can send vRealize Log Insight system notifications to third-party products by using webhooks.

vRealize Log Insight uses webhooks to send alerts over HTTP POST to other applications. vRealize Log
Insight sends a webhook in its own proprietary format, but third-party solutions expect incoming
webhooks to be in their own proprietary format. To use information sent with vRealize Log Insight
webhooks, the third-party application must have either native support for the vRealize Log Insight format
or you must create a mapping between vRealize Log Insight formats and the format used by the third-
party with a shim. The shim translates, or maps, the vRealize Log Insight format to a different format.

The vRealize Log Insight webhook implementation makes outbound HTTP requests to a remote server.
The server may report success or failure, and vRealize Log Insight retries on failure. All HTTP/2xx status
code responses are treated as Success, and all other responses (including timeouts or connection
refused) as failures to be retried later.

Alerts created with message queries, alerts created with aggregate queries, and system notifications
each have their own webhook format.

HTTP basic authentication is supported. Embed credentials in the url using the form {{https://
username:password@hostname/path}}

Webhook Format for a System Notification

The format of a vRealize Log Insight webhook depends on the type of query from which it is created.
System notifications, user alert message queries, and alerts generated from aggregate user queries each
have a different webhook format.

You must be a vRealize Log Insight administrator to configure vRealize Log Insight to send system
notifications.

When you send a system notification to a third-party program, you must write a shim to make vRealize
Log Insight information understandable by the third-party program's formats.

VMware, Inc. 38
Administering vRealize Log Insight

Webhook Format for System Notifications

The following example shows the vRealize Log Insight webhook format for system notifications.

{
"AlertName":" Admin Alert: Worker node has returned to service (Host = [Link])",
"messages":[
{
"text":"This notification was generated from Log Insight node (Host = [Link],
Node Identifier = a31cad22-65c2-4131-8e6c-27790892a1f9).
A worker node has returned to service after having been in maintenance mode.
The Log Insight master node reports that worker node has finished maintenance
and exited maintenance mode. The node will resume receiving configuration changes and
serving queries. The node is also now ready to start receiving incoming log messages."

"timestamp":1458665320514,"fields":[]
}
]
}

Add a vRealize Log Insight Event Forwarding Destination

You can configure a vRealize Log Insight server to forward incoming events to a syslog or Ingestion API
target.

Use event forwarding to send filtered or tagged events to one or more remote destinations such as
vRealize Log Insight or syslog or both. Event forwarding can be used to support existing logging tools
such as SIEM and to consolidate logging over different networks such as DMZ or WAN.

Event forwarders can be standalone or clustered, but an event forwarder is a separate instance from the
remote destination. Instances configured for event forwarding also store events locally and can be used
to query data.

The operators you use to create filters on the Forwarded Events page are different from the filters used
on the interactive analytics page. See Using Event Forwarding Filters in Interactive Analytics for more
information about using the Run in Interactive Analytics menu item to preview the results of your event
filter.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Verify that the destination can handle the number of events that are forwarded. If the destination cluster is
much smaller than the forwarding instance, some events might be dropped.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

VMware, Inc. 39
Administering vRealize Log Insight

2 Under Management, click Event Forwarding.

3 Click New Destination and provide the following information.

Option Description

Name A unique name for the new destination.

Host The IP address or fully qualified domain name.

Caution A forwarding loop is a configuration in which a vRealize Log Insight

cluster forwards events to itself, or to another cluster, which then forwards the
events back to the original cluster. Such a loop might create an indefinite number of
copies of each forwarded event. The vRealize Log Insight Web interface does not
permit you to configure an event to be forwarded to itself. But vRealize Log Insight
is not able to prevent an indirect forwarding loop, such as vRealize Log Insight
cluster A forwarding to cluster B, and B forwarding the same events back to A.
When creating forwarding destinations, take care not to create indirect forwarding
loops.

Protocol Ingestion API, syslog, or RAW. The default value is Ingestion API (CFAPI).
When events are forwarded using the Ingestion API, the event's original source is
preserved in the source field. When events are forwarded using syslog, the event's
original source is lost and the receiver can record the message's source as the
vRealize Log Insight forwarder's IP address or hostname. When events are
forwarded using RAW, the behavior is similar to syslog, but syslog RFC-compliance
is not ensured. RAW forwards an event exactly the way it is received, without a
custom syslog header added by vRealize Log Insight. This protocol is useful for
third-party destinations, because they expect syslog events in their original form.

Note The source field might have different values depending on the protocol
selected on the Event Forwarder:
a For the ingestion API, the source is the initial sender's (the event originator) IP
address.
b For syslog and RAW, the source is the Event Forwarder's vRealize Log Insight
instance IP address. Also, the message text contains _li_source_path which
points to the initial sender's IP address.

Use SSL You can optionally secure the connection with SSL for the ingestion API. The
remote server's trust root is validated and Event Forwarding with SSL does not
work with self-signed certificates installed on destination servers by default. If
untrusted, import the remote server's trusted root certificate to the forwarder's
keystore. See Configure vRealize Log Insight Event Forwarding with SSL.

Tags You can optionally add tag pairs with predefined values. Tags permit you to more
easily query events. You can add multiple comma-separated tags.

Forward Complementary tags You can select whether to forward complementary tags for syslog.
Complementary tags are tags added by the cluster itself, such as 'vc_username' or
'vc_vmname.' and can be forwarded with the tags coming directly from sources.
Complementary tags are always forwarded when Ingestion API is used.

Transport Select a transport protocol for syslog. You can select UDP or TCP.

VMware, Inc. 40
Administering vRealize Log Insight

4 (Optional) To control which events are forwarded, click Add Filter.

Select fields and constraints to define the desired events. Only static fields are available for use as
filters. If you do not select a filter, all events are forwarded. You can see the results of the filter you are
building by clicking Run in Interactive Analytics.

Operator Description

Matches Finds strings that match the string and wildcard specification, where * means zero
or more characters and ? means zero or any single character. Prefix and postfix
globbing is supported.
For example, *test* matches strings such as test123 or my-test-run.

does not match Excludes strings that match the string and wildcard specification, where * means
zero or more characters and ? means zero or any single character. Prefix and
postfix globbing is supported.
For example, test* filters out test123, but does not exclude mytest123. %test*
does not filter out test123, but does exclude xtest123

starts with Finds strings that start with the specified character string.
For example, test finds test123 or test, but not my-test123.

does not start with Excludes strings that start with the specified character string.
For example, test filters out test123, but not my-test123.

5 (Optional) To modify the following forwarding information, click Show Advanced Settings.

Option Description

Port The port to which events are sent on the remote destination. The default value is
set based on the protocol. Do not change unless the remote destination listens on
a different port.

Disk Cache The amount of local disk space to reserve for buffering events that you configure to
be forwarded. Buffering is used when the remote destination is unavailable or
unable to process the events being sent to it. If the local buffer becomes full and
the remote destination is still unavailable, then the newest local events are dropped
and not forwarded to the remote destination even when the remote destination is
back online. The default value is 200 MB.

Worker Count The number of simultaneous outgoing connections to use. Set a higher worker
count for a higher network latency to the forwarded destination and for a greater
number of forwarded events per second. The default value is 8.

6 To verify your configuration, click Test.

7 Click Save.

What to do next

n Configure vRealize Log Insight Event Forwarding with SSL.

n You can edit or clone an event forwarding destination. If you edit the destination to change an event
forwarder name, all statistics are reset.

VMware, Inc. 41
Administering vRealize Log Insight

Configure vRealize Log Insight Event Forwarding with SSL

You can configure a vRealize Log Insight server to forward incoming events to another Log Insight server
via Ingestion API target with SSL.

Prerequisites

Event Forwarding with SSL does not work with the self-signed certificate installed on destination servers
by default. A custom SSL certificate must be created using the steps in Generate a Certificate Signing
Request and then uploaded. See Install a Custom SSL Certificate

Procedure

1 Copy the trusted root certificate into a temporary directory on the forwarder instance. For example /
home.

2 SSH to the forwarder instance and run the following commands.

localhost:~ # cd /usr/java/default/lib/security/
localhost:/usr/java/default/lib/security # ../../bin/keytool
-import -alias loginsight -file /home/[Link] -keystore cacerts

The default keystore password is changeit.

Note Java versions might vary with time.

3 Restart thevRealize Log Insight instance.

If you use a vRealize Log Insight cluster environment, this operation should be performed on all
nodes with the same certificate.

What to do next

Enable SSL connection. See Enforce SSL-Only Connections.

Using Event Forwarding Filters in Interactive Analytics

Operators used in event filters and operators used in filters in interactive analytics do not have a one-to-
one correspondence by name. However, you can select operators that produce similar results for both
formats.

This difference is important when you use the Run in Interactive Analytics menu item from the Event
Forwarding page. For example, if you have an event forwarding filter of matches *foo* and select the
menu item Run in Interactive Analytics from the Event Filters page, the Interactive Analytics query
equates the event forwarding filter to match regexp ^.*foo.*$, which might not match all the same
events.

Another example is matches foo, which when run on interactive analytics is treated as contains foo.
Because the interactive analytics function also searches keyword queries, contains foo is likely to match
more events than matches foo.

VMware, Inc. 42
Administering vRealize Log Insight

You can change the operators used by Interactive Analytics to address these differences.

n Change the contains operator tomatches regex.

n Change occurrences of * from event forwarding filters to .* and prefix filter terms with .*. For example,
change the event filter expression matches *foo* to matches regex .*foo.* for interactive
analytics.

n For the does not match operator from event filters, you can use the matches regex operator with a
regex look ahead value. For example, does not match *foo* is equivalent to matches regex .*(?!
foo).*

Synchronize the Time on the vRealize Log Insight Virtual

Appliance
You must synchronize the time on the vRealize Log Insight virtual appliance with an NTP server or with
the ESX/ESXi host on which you deployed the virtual appliance.

Time is critical to the core functionality of vRealize Log Insight.

By default, vRealize Log Insight synchronizes time with a pre-defined list of public NTP servers. If public
NTP servers are not accessible due to a firewall, you can use the internal NTP server of your company. If
no NTP servers are available, you can sync time with the ESX/ESXi host where you have deployed the
vRealize Log Insight virtual appliance.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click Time.

3 From the Sync time with drop-down menu, select the time source.

Option Description

NTP server Synchronizes the time on the vRealize Log Insight virtual appliance with one of the
listed NTP servers.

ESX/ESXi host Synchronizes the time on the vRealize Log Insight virtual appliance with the ESX/
ESXi host on which you have deployed the virtual appliance.

4 (Optional) If you selected NTP server synchronization, list the NTP server addresses, and click Test.

Note Testing the connection to NTP servers might take up to 20 seconds per server.

5 Click Save.

VMware, Inc. 43
Administering vRealize Log Insight

Configure the SMTP Server for vRealize Log Insight

You can configure an SMTP to allow vRealize Log Insight to send email notifications.

System notifications are generated when vRealize Log Insight detects an important system event, for
example when the storage capacity on the virtual appliance reaches the thresholds that you set.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click SMTP.

3 Type the SMTP server address and port number.

4 If the SMTP server uses an encrypted connection, select the encryption protocol.

5 In the Sender text box, type an email address to use when sending system notifications.

The Sender address appears as the From address in system notification emails. It need not be a real
address, and can be something that represents the specific instance of vRealize Log Insight. For
example, loginsight@[Link].

6 Type a user name and password to authenticate with the SMTP server when sending system
notifications.

7 Type a destination email and click Send Test Email to check the connection.

8 Click Save.

Install a Custom SSL Certificate

By default, vRealize Log Insight installs a self-signed SSL certificate on the virtual appliance.

The self-signed certificate generates security warnings when you connect to the vRealize Log Insight web
user interface. If you do not want to use a self-signed security certificate, you can install a custom SSL
certificate. The only feature requiring a custom SSL certificate is Event Forwarding through SSL. If you
have a Cluster setup with ILB enabled, see Enable the Integrated Load Balancer for the specific
requirements of a custom SSL certificate.

Note The vRealize Log Insight Web user interface and the Log Insight Ingestion protocol cfapi use the
same certificate for authentication.

VMware, Inc. 44
Administering vRealize Log Insight

Prerequisites

n Verify that your custom SSL certificate meets the following requirements.

n The CommonName contains a wildcard or exact match for the Master node or FQDN of the
virtual IP address. Optionally, all other IP addresses and FQDNs are listed as subjectAltName.

n The certificate file contains both a valid private key and a valid certificate chain.

n The private key is generated by the RSA or the DSA algorithm.

n The private key is not encrypted by a pass phrase.

n If the certificate is signed by a chain of other certificates, all other certificates are included in the
certificate file that you plan to import.

n The private key and all the certificates that are included in the certificate file are PEM-encoded.
vRealize Log Insight does not support DER-encoded certificates and private keys.

n The private key and all the certificates that are included in the certificate file are in the PEM
format. vRealize Log Insight does not support certificates in the PFX, PKCS12, PKCS7, or other
formats.

n Verify that you concatenate the entire body of each certificate into a single text file in the following
order.

a The Private Key - your_domain_name.key

b The Primary Certificate - your_domain_name.crt

c The Intermediate Certificate - [Link]

d The Root Certificate - [Link]

n Verify that you include the beginning and ending tags of each certificate in the following format.

-----BEGIN PRIVATE KEY-----

(Your Private Key: your_domain_name.key)
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: your_domain_name.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Intermediate certificate: [Link])
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Root certificate: [Link])
-----END CERTIFICATE-----

VMware, Inc. 45
Administering vRealize Log Insight

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

Procedure

1 Generate a Self-Signed Certificate

You can generate a self-signed certificate for Windows or Linux by using the OpenSSL tool.

2 Generate a Certificate Signing Request

Generate a certificate-signing request by using the OpenSSL tool for Windows.

3 Request a Signature from a Certificate Authority

Send your certificate signing request to a Certificate Authority of your choice and request a
signature.

4 Concatenate Certificate Files

Combine your key and certificate files into a PEM file.

5 Upload Signed Certificate

You can upload a signed SSL certificate.

6 Configure SSL Connection Between the vRealize Log Insight Server and the Log Insight Agents
SSL function allows you to provide SSL only connections between the Log Insight Agents and the
vRealize Log Insight Server through the secure flow of Ingestion API. You can also configure various
SSL parameters of the Log Insight Agents.

Generate a Self-Signed Certificate

You can generate a self-signed certificate for Windows or Linux by using the OpenSSL tool.

Prerequisites

n Download the appropriate installer for OpenSSL from [Link]

[Link]. Use the downloaded OpenSSL installer to install it on Windows.

n Edit the [Link] file to add additional required parameters. Make sure the [req] section has
the req_extensions parameter defined.

[req]
.
.
req_extensions=v3_req #

VMware, Inc. 46
Administering vRealize Log Insight

n Add an appropriate Subject Alternative Name entry for the hostname or IP address of your server, for
example [Link]. You cannot specify a pattern for the hostname.

[v3_req]
.
.
subjectAltName=DNS:[Link]
#subjectAltName=IP:[Link]

Procedure

1 Create a folder to save your certificate files, for example C:\Certs\LogInsight.

2 Open a command prompt and run the following command.

C:\Certs\LogInsight>openssl req -x509 -nodes -newkey 2048 -keyout [Link] -out [Link] -
days 3650

OpenSSL prompts you to supply certificate properties, including country, organization, and so on.

3 Enter the exact IP address or hostname of your vRealize Log Insight server, or the vRealize Log
Insight cluster address if load balancing is enabled.

This property is the only one for which it is mandatory to specify a value.

Results

Two files are created, [Link] and [Link].

n [Link] is a new PEM-encoded private key.

n [Link] is a new PEM-encoded certificate signed by [Link].

Generate a Certificate Signing Request

Generate a certificate-signing request by using the OpenSSL tool for Windows.

Prerequisites

n Install the OpenSSL tool. See [Link] for information about obtaining the OpenSSL
tool.

n Edit the [Link] file to add additional required parameters. Make sure the [req] section has
the req_extensions parameter defined.

[req]
.
.
req_extensions=v3_req #

VMware, Inc. 47
Administering vRealize Log Insight

n Add an appropriate Subject Alternative Name entry for the hostname or IP address of your server, for
example [Link]. You cannot specify a pattern for the hostname.

[v3_req]
.
.
subjectAltName=DNS:[Link]
#subjectAltName=IP:[Link]

Procedure

1 Create a folder to save your certificate files, for example C:\Certs\LogInsight.

2 Open a Command Prompt and run the following command to generate your private key.

C:\Certs\LogInsight>openssl genrsa -out [Link] 2048

3 Create a certificate signing request by running the following command.

C:\Certs\LogInsight>openssl req -new -key [Link] -out [Link]

Note This command runs interactively and asks you a number of questions. Your certificate authority
will cross check your answers. Your answers must match the legal documents regarding the
registration of your company.

4 Follow the onscreen instructions and enter the information that will be incorporated into your
certificate request.

Important In the Common Name field, enter the hostname or IP address of your server, for example
[Link]. If you want to include all subdomains, enter *[Link].

Results

Your certificate signing request file [Link] is generated and saved.

Request a Signature from a Certificate Authority

Send your certificate signing request to a Certificate Authority of your choice and request a signature.

Procedure

u Submit your [Link] file to a Certificate Authority.

Note Request that the Certificate Authority encode your file in the PEM format.

The Certificate Authority processes your request and sends you back a [Link] file encoded in
the PEM format.

Concatenate Certificate Files

Combine your key and certificate files into a PEM file.

VMware, Inc. 48
Administering vRealize Log Insight

Procedure

1 Create a new [Link] file and open it in a text editor.

2 Copy the contents of your [Link] file and paste it in [Link] using the following format.

-----BEGIN RSA PRIVATE KEY-----

(Your Private Key: [Link])
-----END RSA PRIVATE KEY-----

3 Copy the contents of the [Link] file you received from a certificate authority and paste it in
[Link] using the following format.

-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: [Link])
-----END CERTIFICATE-----

4 If the Certificate Authorities provided you with an intermediate or chained certificate, append the
intermediate or chained certificates to the end of the public certificate file in the following format.

-----BEGIN RSA PRIVATE KEY-----

(Your Private Key: [Link])
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: [Link])
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Intermediate certificate: [Link])
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Root certificate: [Link])
-----END CERTIFICATE-----

5 Save your [Link] file.

Upload Signed Certificate

You can upload a signed SSL certificate.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click SSL Certificate.

3 Browse to your custom SSL certificate and click Open.

4 Click Save.

5 Restart vRealize Log Insight.

VMware, Inc. 49
Administering vRealize Log Insight

What to do next

After vRealize Log Insight restarts, verify that syslog feeds from ESXi continue to arrive in vRealize Log
Insight.

Configure SSL Connection Between the vRealize Log Insight

Server and the Log Insight Agents
SSL function allows you to provide SSL only connections between the Log Insight Agents and the
vRealize Log Insight Server through the secure flow of Ingestion API. You can also configure various SSL
parameters of the Log Insight Agents.

vRealize Log Insight Agents communicate over TLSv.1.2. SSLv.3/TLSv.1.0 is disabled to meet security
guidelines.

Main SSL Functions

Understanding of the main SSL functions can help you configure the Log Insight Agents properly.

The vRealize Log Insight Agent stores certificates and uses them to verify the identity of the server during
all but the first connection to a particular server. If the server identity cannot be confirmed, the vRealize
Log Insight Agent rejects connection with server and writes an appropriate error message to the log.
Certificates received by the Agent are stored in cert folder.

n For Windows go to C:\ProgramData\VMware\Log Insight Agent\cert.

n For Linux go to /var/lib/loginsight-agent/cert.

When the vRealize Log Insight Agent establishes secure connection with the vRealize Log Insight Server,
the Agent checks the certificate received from the vRealize Log Insight Server for validity. The vRealize
Log Insight Agent uses system-trusted root certificates.

n The Log Insight Linux Agent loads trusted certificates from /etc/pki/tls/certs/[Link]
or /etc/ssl/certs/[Link].

n The Log Insight Windows Agent uses system root certificates.

If the vRealize Log Insight Agent has a locally stored self-signed certificate and receives a different valid
self-signed certificate with the same public key, then the agent accepts the new certificate. This can
happen when a self-signed certificate is regenerated using the same private key but with different details
like new expiration date. Otherwise, connection is rejected.

If the vRealize Log Insight Agent has a locally stored self-signed certificate and receives valid CA-signed
certificate, the vRealize Log Insight Agent silently replaces new accepted certificate.

If the vRealize Log Insight Agent receives self-signed certificate after having a CA-signed certificate, the
Log Insight Agent rejects it. The vRealize Log Insight Agent accepts self-signed certificate received from
vRealize Log Insight Server only when it connects to the server for the first time.

VMware, Inc. 50
Administering vRealize Log Insight

If the vRealize Log Insight Agent has a locally stored CA-signed certificate and receives a valid certificate
signed by another trusted CA, the Agent rejects it. You can modify the configuration options of the
vRealize Log Insight Agent to accept the new certificate. See Configure the vRealize Log Insight Agent
SSL Parameters.

vRealize Log Insight Agents communicate over TLSv.1.2. SSLv.3/TLSv.1.0 is disabled to meet security
guidelines.

Enforce SSL-Only Connections

You can use the vRealize Log Insight Web user interface to configure the vRealize Log Insight Agents
and the Ingestion API to allow only SSL connections to the server.

The vRealize Log Insight API is normally reachable through HTTP on port 9000 and through HTTPS on
port 9543. Both ports can be used by the vRealize Log Insight Agent or custom API clients. All
authenticated requests require SSL, but unauthenticated requests, including vRealize Log Insight agent
ingestion traffic, can be performed with either. You can force all API request to use SSL connections. The
option does not restrict syslog port 514 traffic or affect the vRealize Log Insight user interface, for which
HTTP port 80 requests continue redirecting to HTTPS port 443.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click SSL.

3 Under the API Server SSL, select Require SSL Connection.

4 Click Save.

Results

vRealize Log Insight API allows only SSL connections to the server. Non-SSL connections are refused.

Configure the vRealize Log Insight Agent SSL Parameters

You can edit the vRealize Log Insight agent configuration file to change the SSL configuration, add a path
to the trusted root certificates, and say whether the agent accepts certificates.

This procedure applies to the vRealize Log Insight agents for Windows and Linux.

Prerequisites

For the vRealize Log Insight Linux agent:

n Log in as root or use sudo to run console commands.

VMware, Inc. 51
Administering vRealize Log Insight

n Log in to the Linux machine on which you installed the vRealize Log Insight Linux agent, open a
console and run pgrep liagent to verify that the vRealize Log Insight Linux agent is installed and
running.

For the vRealize Log Insight Windows agent:

n Log in to the Windows machine on which you installed the vRealize Log Insight Windows agent and
start the Services manager to verify that the vRealize Log Insight agent service is installed.

Procedure

1 Navigate to the folder containing the [Link] file.

Operating system Path

Linux /var/lib/loginsight-agent/

Windows %ProgramData%\VMware\Log Insight Agent

2 Open the [Link] file in any text editor.

3 Add the following keys to the [server]section of the [Link] file.

Key Description

ssl_ca_path Overrides the default storage path for root Certificate

Authority-signed certificates, which are used to verify
connection peer certificates.
When you provide a path for ssl_ca_path, you override the
defaults for both Linux and Windows agents. You can use a
file where multiple certificates in PEM format are
concatenated or a directory that contains certificates are in
PEM format and have names of the form hash.0. (See the
-hash option of the x509 utility.)
Linux: If no value is specified, the agent uses the value
assigned to the LI_AGENT_SSL_CA_PATH environment
variable. If that value is not present, the agent attempts to
load trusted certificates from the/etc/pki/tls/certs/ca-
[Link] file or from the /etc/ssl/certs/ca-
[Link] file.
Windows: If no value is specified, the agent uses the value
specified by the LI_AGENT_SSL_CA_PATH environment
variable. If that value is not present, the vRealize Log Insight
Windows agent loads certificates from the Windows root
certificate store.

ssl_accept_any Defines whether any certificates are accepted by the vRealize

Log Insight agent. The possible values are yes, 1, no, or 0.
When the value is set to yes or 1, the agent accepts any
certificate from the server and establish secure connection for
sending data. The default value is no.

VMware, Inc. 52
Administering vRealize Log Insight

Key Description

ssl_accept_any_trusted The possible values are yes, 1, no, or 0. If the vRealize Log
Insight agent has a locally stored trusted Certificate Authority-
signed certificate and receives a different valid certificate
signed by a different trusted Certificate Authority, it checks the
configuration option. If the value is set to yes or 1, the agent
accepts the new valid certificate. If the value is set to no or 0,
it rejects the certificate and ends the connection. The default
value is no.

ssl_cn The Common Name of the self-signed certificate.

The default value is VMware vCenter Log Insight. You can
define a custom Common Name to be checked against the
certificate Common Name field. The vRealize Log Insight agent
compares the Common Name field of the received certificate to
the host name specified for the hostname key in the [server]
section. If they do not match, the agent checks the Common
Name text box against the ssl_cn key in the [Link] file.
If the values match, the vRealize Log Insight agent accepts
the certificate.

Note These keys are ignored if SSL is disabled.

4 Save and close the [Link] file.

Example: Configuration
The following is an example of the SSL configuration.

proto=cfapi
port=9543
ssl=yes
ssl_ca_path=/etc/pki/tls/certs/[Link]
ssl_accept_any=no
ssl_accept_any_trusted=yes
ssl_cn=LOGINSIGHT

Change the Default Timeout Period for vRealize Log

Insight Web Sessions
By default, to keep your environment secure, vRealize Log Insight Web sessions expire in 30 minutes.
You can increase or decrease the timeout duration.

You can modify the timeout period by using the Web UI.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

VMware, Inc. 53
Administering vRealize Log Insight

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click General.

3 In the Browser Session pane, specify a timeout value in minutes.

The value -1 disables session timeouts.

4 Click Save.

Archiving
You configure vRealize Log Insight to archive log data if you want to retain logs for an extended period of
time.

Enable or Disable Data Archiving in vRealize Log Insight

Data archiving preserves old logs that might otherwise be removed from the vRealize Log Insight virtual
appliance due to storage constraints. vRealize Log Insight can store archived data to NFS mounts.

vRealize Log Insight collects and stores logs on-disk in a series of 0.5-GB buckets. A bucket consists of
compressed log files and an index. A bucket contains everything necessary to perform queries for a
specific time range. When the size of the bucket exceeds 0.5 GB, vRealize Log Insight stops writing,
closes all files in the bucket and seals the bucket.

When you archive data, vRealize Log Insight copies raw compressed log files from the bucket to an NFS
mount when the bucket is sealed. Buckets that have been sealed when data archiving is not enabled are
not retroactively archived.

The path created within an archive export is in the form

year/month/day/hour/bucketuuid/[Link], using the timestamp at which the bucket was
originally created in UTC.

Note vRealize Log Insight does not manage the NFS mount used for archiving purposes. If system
notifications are enabled, vRealize Log Insight sends an email when the NFS mount is about to run out of
space or is unavailable. If the NFS mount does not have enough free space or is unavailable for longer
than the retention period of the virtual appliance, vRealize Log Insight stops ingesting new data. It begins
to ingest data again when the NFS mount has enough free space, becomes available, or archiving is
disabled.

Do not mount NFS permanently or changes the /etc/fstab file. vRealize Log Insight itself performs NFS
mounting for you.

Prerequisites

n Verify that you have access to an NFS partition that meets the following requirements.

n The NFS partition must allow reading and writing operations for guest accounts.

n The mount must not require authentication.

VMware, Inc. 54
Administering vRealize Log Insight

n The NFS server must support NFS v3.

n If using a Windows NFS server, allow unmapped user UNIX access (by UID/GID).

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click Archiving.

3 Select Enable Data Archiving and enter the path to an NFS partition where logs are archived in the
form nfs://servername<:port-number>/exportname.

The port number defaults to 2049.

4 Click Test to verify the connection.

5 Click Save.

Results

Note Data archiving preserves log events that have since been removed from the vRealize Log Insight
virtual appliance due to storage constraints. Log events that have been removed from the vRealize Log
Insight virtual appliance, but have been archived are no longer searchable. If you want to search archived
logs, you must import them into a vRealize Log Insight instance. For more information about importing
archived log files, see Import a vRealize Log Insight Archive into vRealize Log Insight.

What to do next

After vRealize Log Insight restarts, verify that syslog feeds from ESXi continue to arrive in vRealize Log
Insight.

Format of the vRealize Log Insight Archive Files

vRealize Log Insight archives data in a specific format.

vRealize Log Insight stores archive files on an NFS server and organizes them in hierarchical directories
based on archiving time. For example,

/backup/2014/08/07/16/bd234b2d-df98-44ae-991a-e0562f10a49/[Link]

where /backup is the NFS location, 2014/08/07/16 is the archiving time, bd234b2d-df98-44ae-991a-
e0562f10a49 is the bucket ID, and [Link] is the archived data for the bucket.

The archive data [Link] is a compressed file that uses vRealize Log Insight internal encoding. It
contains the original content for all of the messages stored in the bucket, together with the static fields
such as timestamp, host name, source, and appname.

VMware, Inc. 55
Administering vRealize Log Insight

You can import archived data to vRealize Log Insight, export archive data to a raw text file, and extract
message content from archive data. See Export a Log Insight Archive to a Raw Text File or JSON and
Import a vRealize Log Insight Archive into vRealize Log Insight.

Import a vRealize Log Insight Archive into vRealize Log Insight

Data archiving preserves old logs that might otherwise be removed from the vRealize Log Insight virtual
appliance due to storage constraints. See Enable or Disable Data Archiving in vRealize Log Insight. You
can use the command line to import logs that have been archived in vRealize Log Insight.

Note Although vRealize Log Insight can handle historic data and real-time data simultaneously, you are
advised to deploy a separate instance of vRealize Log Insight to process imported log files.

Prerequisites

n Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

n Verify that you have access to the NFS server where vRealize Log Insight logs are archived.

n Verify that the vRealize Log Insight virtual appliance has enough disk space to accommodate the
imported log files.

The minimum free space in the /storage/core partition on the virtual appliance must equal
approximately 10 times the size of the archived log that you want to import.

Procedure

1 Establish an SSH connection to the vRealize Log Insight vApp and log in as the root user.

2 Mount the shared folder on the NFS server where the archived data resides.

3 To import a directory of archived vRealize Log Insight logs, run the following command.

/usr/lib/loginsight/application/bin/loginsight repository import Path-To-Archived-Log-Data-Folder.

Note Importing archived data might take a long time, depending on the size of the imported folder.

4 Close the SSH connection.

What to do next

You can search, filter, and analyze the imported log events.

Export a Log Insight Archive to a Raw Text File or JSON

You can use the command line to export a vRealize Log Insight archive to a regular raw text file or in
JSON format.

Note This is an advanced procedure. Command syntax and output formats might change in later
releases of vRealize Log Insight without backward compatibility.

VMware, Inc. 56
Administering vRealize Log Insight

Prerequisites

n Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

n Verify that the vRealize Log Insight virtual appliance has enough disk space to accommodate the
exported files.

Procedure

1 Establish an SSH connection to the vRealize Log Insight vApp and log in as the root user.

2 Create an archive directory on the vRealize Log Insight vApp.

mkdir /archive

3 Mount the shared folder on the NFS server where the archived data resides by running the following
command.

mount -t nfs archive-fileshare:archive directory path /archive

4 Check the available storage space on the vRealize Log Insight vApp.

df -h

5 Export a vRealize Log Insight archive to a raw text file.

/usr/lib/loginsight/application/sbin/repo-exporter –d archive-file-directory output-file

For example,

/usr/lib/loginsight/application/sbin/repo-exporter –d /archive/2014/08/07/16/bd234b2d-
df98-44ae-991a-e0562f10a49 /tmp/[Link]

6 Export a vRealize Log Insight archive message content in JSON format.

/usr/lib/loginsight/application/sbin/repo-exporter -F –d archive-file-directory output-file.

For example,

/usr/lib/loginsight/application/sbin/repo-exporter –F –d /archive/2014/08/07/16/bd234b2d-
df98-44ae-991a-e0562f10a49 /tmp/[Link]

7 Close the SSH connection.

Restart the vRealize Log Insight Service

You can restart vRealize Log Insight by using the Administration page in the Web user interface.

Caution Restarting vRealize Log Insight closes all active user sessions. Users of the vRealize Log
Insight instance will be forced to log in again.

VMware, Inc. 57
Administering vRealize Log Insight

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Cluster.

3 Select a cluster node.

4 Click Restart Master and click Restart.

What to do next

After vRealize Log Insight restarts, verify that syslog feeds from ESXi continue to arrive in vRealize Log
Insight.

Power Off the vRealize Log Insight Virtual Appliance

To avoid data loss when powering off a vRealize Log Insight master or worker node, you must power the
node off by following a strict sequence of steps.

You must power off the vRealize Log Insight virtual appliance before making changes to the virtual
hardware of the appliance.

You can power off the vRealize Log Insight virtual appliance by using the Power > Shut Down Guest
menu option in the vSphere Client, by using the virtual appliance console, or by establishing an SSH
connection to the vRealize Log Insight virtual appliance and running a command.

Prerequisites

n If you plan to connect to the vRealize Log Insight virtual appliance by using SSH, verify that TCP port
22 is open.

n Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

Procedure

1 Establish an SSH connection to the vRealize Log Insight vApp and log in as the root user.

2 To power off the vRealize Log Insight virtual appliance, run shutdown -h now.

What to do next

You can safely modify the virtual hardware of the vRealize Log Insight virtual appliance.

VMware, Inc. 58
Administering vRealize Log Insight

Download a vRealize Log Insight Support Bundle

If vRealize Log Insight does not operate as expected because of a problem, you can send a copy of the
log and configuration files to VMware Support Services in the form of a support bundle.

Downloading a cluster-wide support bundle is necessary only if requested by VMware Support Services.
You can create the bundle either statically, which uses disk space on the node, or by streaming, which
uses no disk space on the node and stores the bundle on your initiating machine by default.

The storage location for the support bundle depends on the option that you use to get the support bundle:

Option Support Bundle Location

API - POST appliance/vm-support-bundle This is a streaming version with no local file.

API - POST appliance/support-bundle /tmp/ui-support/

Web user interface - Static support bundle /tmp/ui-support/

Web user interface - Streaming support bundle This is a streaming version with no local file.

Command line - scripts/loginsight-support The bundle is generated in the current directory.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Cluster.

3 Under the Support header, click Download Support Bundle.

The vRealize Log Insight system collects the diagnostic information and sends the data to your
browser in a compressed tarball.

4 Choose the method to create the bundle.

n Select Static support bundle to create a bundle locally. Creation of the bundle consumes disk
space on the node.

n Select Streaming support bundle to start streaming the support bundle immediately. This
method uses no disk space on the node.

5 Click Continue.

6 In the File Download dialog box, click Save.

7 Select a location to which you want to save the tarball archive and click Save.

VMware, Inc. 59
Administering vRealize Log Insight

What to do next

You can review the contents of log files for error messages. When you resolve or close issues, delete the
outdated support bundle to save disk space.

Join or Leave the VMware Customer Experience

Improvement Program
You can join or leave the VMware Customer Experience Improvement Program after deploying vRealize
Log Insight

You choose whether to participate in the Customer Experience Improvement Program when you install
vRealize Log Insight. After installation, you can join or leave the program by following these steps.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Configuration, click General.

3 In the Customer Experience Improvement Program pane, select or clear the Join the VMware
Customer Experience Improvement Program check box.

When selected, the option activates the Program and sends data to [Link]

4 Click Save.

VMware, Inc. 60
 5
Managing vRealize Log Insight
Clusters

You can add, remove, and upgrade the nodes of a vRealize Log Insight cluster.

Note vRealize Log Insight does not support WAN clustering. Current versions of vRealize Log Insight do
not support WAN clustering (also called geo-clustering, high-availability clustering, or remote clustering).
All nodes in the cluster should be deployed in the same Layer 2 LAN. In addition, the ports described in
Chapter 6 Ports and External Interfaces must be opened between nodes for proper communication.

This chapter includes the following topics:

n Add a Worker Node to a vRealize Log Insight Cluster

n Remove a Worker Node from a vRealize Log Insight Cluster

n Working with an Integrated Load Balancer

n Query the Results of In-Production Cluster Checks

Add a Worker Node to a vRealize Log Insight Cluster

Deploy a new instance of the Log Insight virtual appliance and add it to an existing Log Insight master
node.

Procedure

1 Deploy the vRealize Log Insight Virtual Appliance

Download the vRealize Log Insight virtual appliance. VMware distributes the vRealize Log Insight
virtual appliance as an .ova file. Deploy the vRealize Log Insight virtual appliance by using the
vSphere Client.

2 Join an Existing Deployment

After you deploy and set up a standalone vRealize Log Insight node, you can deploy a new vRealize
Log Insight instance and add it to the existing node to form a vRealize Log Insight cluster.

Deploy the vRealize Log Insight Virtual Appliance

Download the vRealize Log Insight virtual appliance. VMware distributes the vRealize Log Insight virtual
appliance as an .ova file. Deploy the vRealize Log Insight virtual appliance by using the vSphere Client.

VMware, Inc. 61
Administering vRealize Log Insight

Prerequisites

n Verify that you have a copy of the vRealize Log Insight virtual appliance .ova file.

n Verify that you have permissions to deploy OVF templates to the inventory.

n Verify that your environment has enough resources to accommodate the minimum requirements of
the vRealize Log Insight virtual appliance. See Minimum Requirements.

n Verify that you have read and understand the virtual appliance sizing recommendations. See Sizing
the Log Insight Virtual Appliance.

Procedure

1 In the vSphere Client, select File > Deploy OVF Template.

2 Follow the prompts in the Deploy OVF Template wizard.

3 On the Select Configuration page, select the size of the vRealize Log Insight virtual appliance based
on the size of the environment for which you intend to collect logs.

Small is the minimum requirement for production environments.

vRealize Log Insight provides preset VM (virtual machine) sizes that you can select from to meet the
ingestion requirements of your environment. These presets are certified size combinations of
compute and disk resources, though you can add extra resources afterward. A small configuration
consumes the fewest resources while remaining supported. An extra small configuration is suitable
only for demos.

Syslog Connections (Active

Preset Size Log Ingest Rate Virtual CPUs Memory IOPS TCP Connections) Events per Second

Extra Small 6 GB/day 2 4 GB 75 20 400

Small 30 GB/day 4 8 GB 500 100 2000

Medium 75 GB/day 8 16 GB 1000 250 5000

Large 225 GB/day 16 32 GB 1500 750 15,000

You can use a syslog aggregator to increase the number of syslog connections that send events to
vRealize Log Insight. However, the maximum number of events per second is fixed and does not
depend on the use of a syslog aggregator. A vRealize Log Insight instance cannot be used as a
syslog aggregator.

Note If you select Large, you must upgrade the virtual hardware on the vRealize Log Insight virtual
machine after the deployment.

4 On the Select Storage page, select a disk format.

n Thick Provision Lazy Zeroed creates a virtual disk in a default thick format. Space required for
the virtual disk is allocated when the virtual disk is created. The data remaining on the physical
device is not erased during creation, but is zeroed out on demand later, on first write from the
virtual appliance.

VMware, Inc. 62
Administering vRealize Log Insight

n Thick Provision Eager Zeroed creates a type of thick virtual disk that supports clustering
features such as Fault Tolerance. Space required for the virtual disk is allocated at creation time.
In contrast to the flat format, the data remaining on the physical device is zeroed out when the
virtual disk is created. It might take much longer to create disks in this format than to create other
types of disks.

Important Deploy the vRealize Log Insight virtual appliance with thick provisioned eager zeroed
disks whenever possible for better performance and operation of the virtual appliance.

n Thin Provision creates a disk in thin format. The disk grows as the data saved on it grows. If
your storage device does not support thick provisioning disks or you want to conserve unused
disk space on the vRealize Log Insight virtual appliance, deploy the virtual appliance with thin
provisioned disks.

Note Shrinking disks on the vRealize Log Insight virtual appliance is not supported and might result
in data corruption or data loss.

5 (Optional) On the Setup networks page, set the networking parameters for the vRealize Log Insight
virtual appliance.

If you do not provide network settings, such as an IP address, DNS servers, and gateway information,
vRealize Log Insight utilizes DHCP to set those settings.

Caution Do not specify more than two domain name servers. If you specify more than two domain
name servers, all configured domain name servers are ignored in the vRealize Log Insight virtual
appliance.

Use a comma-separated list to specify domain name servers.

6 (Optional) On the Customize template page, set network properties if you are not using DHCP.

7 (Optional) On the Customize template page, select Other Properties and set the root password for
the vRealize Log Insight virtual appliance.

The root password is required for SSH. You can also set this password through the VMware Remote
Console.

8 Follow the prompts to complete the deployment.

For information on deploying virtual appliances, see the User's Guide to Deploying vApps and Virtual
Appliances.

After you power on the virtual appliance, an initialization process begins. The initialization process
takes several minutes to complete. At the end of the process, the virtual appliance restarts.

VMware, Inc. 63
Administering vRealize Log Insight

9 Navigate to the Console tab and check the IP address of the vRealize Log Insight virtual appliance.

IP Address Prefix Description

https:// The DHCP configuration on the virtual appliance is correct.

http:// The DHCP configuration on the virtual appliance failed.

a Power off the vRealize Log Insight virtual appliance.
b Right-click the virtual appliance and select Edit Settings.
c Set a static IP address for the virtual appliance.

What to do next

n If you want to configure a standalone vRealize Log Insight deployment, see Configure New Log
Insight Deployment.

The vRealize Log Insight Web interface is available at [Link] where log-insight-host
is the IP address or host name of the vRealize Log Insight virtual appliance.

Join an Existing Deployment

After you deploy and set up a standalone vRealize Log Insight node, you can deploy a new vRealize Log
Insight instance and add it to the existing node to form a vRealize Log Insight cluster.

vRealize Log Insight can scale out by using multiple virtual appliance instances in clusters. Clusters
enable linear scaling of ingestion throughput, increase query performance, and allow high-availability
ingestion. In cluster mode, vRealize Log Insight provides master and worker nodes. Both master and
worker nodes are responsible for a subset of data. Master nodes can query all subsets of data and
aggregate the results. You might require more nodes to support site needs. You can use from three to 12
nodes in a cluster. This means a fully functional cluster must have a minimum of three healthy nodes. The
majority of nodes in a larger cluster must be healthy. For example, if three nodes of a six-node cluster fail,
none of the nodes functions fully until the failing nodes are removed.

Prerequisites

n In the vSphere Client, note the IP address of the worker vRealize Log Insight virtual appliance.

n Verify that you have the IP address or host name of the master vRealize Log Insight virtual appliance.

n Verify that you have an administrator account on the master vRealize Log Insight virtual appliance.

n Verify that the versions of the vRealize Log Insight master and worker nodes are in sync. Do not add
an older version vRealize Log Insight worker to a newer version vRealize Log Insight master node.

n You must synchronize the time on the vRealize Log Insight virtual appliance with an NTP server. See
Synchronize the Time on the Log Insight Virtual Appliance.

n For information on supported browser versions, see the vRealize Log Insight Release Notes.

VMware, Inc. 64
Administering vRealize Log Insight

Procedure

1 Use a supported browser to navigate to the web user interface of the vRealize Log Insight worker.

The URL format is [Link] where log_insight-host is the IP address or host name of
the vRealize Log Insight worker virtual appliance.

The initial configuration wizard opens.

2 Click Join Existing Deployment.

3 Enter the IP address or host name of the vRealize Log Insight master and click Go.

The worker sends a request to the vRealize Log Insight master node to join the existing deployment.

4 Click Click here to access the Cluster Management page.

5 Log in as an administrator.

The Cluster page loads.

6 Click Allow.

The worker node joins the existing deployment and vRealize Log Insight begins to operate in a
cluster.

What to do next

n Add more worker nodes as needed. The cluster must have a minimum of three nodes.

Remove a Worker Node from a vRealize Log Insight

Cluster
You can remove a worker node that is no longer working correctly from a vRealize Log Insight cluster. Do
not remove worker nodes that are operating correctly from a cluster.

Warning Removing a node results in data loss. If a node must be removed, ensure that it has been
backed up first. Avoid removing nodes within 30 minutes of adding new nodes.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Cluster.

VMware, Inc. 65
Administering vRealize Log Insight

3 In the Workers table, find the node you want, click the pause icon, and click Continue.

The node is now in maintenance mode.

Note A node in maintenance mode continues to receive logs.

4 Click to remove the node.

vRealize Log Insight removes the node from the cluster and sends out an email notification.

5 Once removed, a node can be bootstrapped as a standalone node or bootstrapped and joined to a
cluster.

Working with an Integrated Load Balancer

The vRealize Log Insight integrated load balancer (ILB) supports vRealize Log Insight clusters and
ensures that incoming ingestion traffic is accepted by vRealize Log Insight even if some vRealize Log
Insight nodes become unavailable. You can also configure multiple virtual IP addresses.

Note External load balancers are not supported for use with vRealize Log Insight, including vRealize
Log Insight clusters.

It is a best practice to include the ILB in all deployments, including single-node instances. Send queries
and ingestion traffic to the ILB so that a cluster can easily be supported in the future if needed. The ILB
balances traffic across nodes in a cluster and minimizes administrative overhead.

The ILB ensures that incoming ingestion traffic is accepted by vRealize Log Insight even if some vRealize
Log Insight nodes become unavailable. The ILB also balances incoming traffic fairly among available
vRealize Log Insight nodes. vRealize Log Insight clients, using both the web user interface and ingestion
(through syslog or the Ingestion API), connect to vRealize Log Insight through the ILB address.

ILB requires that all vRealize Log Insight nodes be on the same Layer 2 networks, such as behind the
same switch or otherwise able to receive ARP requests from and send ARP requests to each other. The
ILB IP address must be set up so that any vRealize Log Insight node can own it and receive traffic for it.
Typically, this means that the ILB IP address is in the same subnet as the physical address of the
vRealize Log Insight nodes. After you configure the ILB IP address, try to ping it from a different network
to ensure that it is reachable.

To simplify future changes and upgrades, you can have clients point to an FQDN that resolves to the ILB
IP address, instead of pointing directly to the ILB IP address.

About Direct Server Return Configuration

The vRealize Log Insight load balancer uses a Direct Server Return (DSR) configuration. In DSR, all
incoming traffic passes through the vRealize Log Insight node that is the current load balancer node.
Return traffic is sent from vRealize Log Insight servers directly back to the client without needing to go
through the load balancer node.

VMware, Inc. 66
Administering vRealize Log Insight

Multiple Virtual IP Addresses

You can configure multiple virtual IP addresses (vIPs) for the Integrated Load Balancer. You can also
configure a list of static tags to each vIP so that each log message received from the vIP is annotated
with the configured tags.

Enable the Integrated Load Balancer

When you enable the vRealize Log Insight integrated load balancer (ILB) on a vRealize Log Insight
cluster, you must configure one or more virtual IP addresses.

The Integrated Load Balancer supports one or more virtual IP addresses (vIPs). Each vIP balances
incoming ingestion and query traffic among available vRealize Log Insight nodes. It's a best practice to
connect all vRealize Log Insight clients through a vIP and not directly to a node.

To simplify future changes and upgrades, you can have clients point to a FQDN that resolves to the ILB
IP address, instead of pointing directly to the ILB IP address. vSphere and vRealize Operations
integrations as well as alert messages use the FQDN if provided. Otherwise, they use the ILB IP address.
vRealize Log Insight should be able to resolve the FQDN to the given IP address, which means that the
FQDN value you specify should match what is defined in DNS.

Prerequisites

n Verify that all vRealize Log Insight nodes and the specified Integrated Load Balancer IP address are
on the same network.

n If you are using vRealize Log Insight with NSX, verify that the Enable IP Discovery option is disabled
on the NSX logical switch.

n The vRealize Log Insight master and worker nodes must have the same certificates. Otherwise, the
vRealize Log Insight Agents configured to connect through SSL reject the connection. When
uploading a CA-signed certificate to vRealize Log Insight master and worker nodes, set the Common
Name to the ILB FQDN (or IP address) during the certificate generation request. See Generate a
Certificate Signing Request .

n You must synchronize the time on the vRealize Log Insight virtual appliance with an NTP server. See
Synchronize the Time on the Log Insight Virtual Appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Cluster.

3 In the Integrated Load Balancer section, select New Virtual IP Address and enter the virtual IP (vIP)
address to use for integrated load balancing.

4 (Optional) To configure multiple virtual IP addresses, click New Virtual IP Address and enter the IP
address. You can choose to enter the FQDN and tags.

n Each vIP should be in the same subnet as at least one network interface on each node and the
vIP must be available (not used by any other machine).

VMware, Inc. 67
Administering vRealize Log Insight

n Tags let you add fields with predefined values to events for easier querying. You can add multiple
comma-separated tags. All events coming into the system thru a vIP are marked with the vIP's
tags.

n You can configure a list of static tags (key=value) for an ILB vIP, so that each log message
received from the vIP is annotated with the configured tags.

5 (Optional) To enable vRealize Log Insight users to access the cluster via FQDN, point the clients to
the FQDN instead of directly to the configured ILB IP address.

You might want to have clients point to a FQDN that resolves to an IBM IP address to simplify future
changes and upgrades, you can have clients point to a FQDN instead of pointing directly to the ILB IP
address.

6 Click Save.

The Integrated Load Balancer is managed by one node in the vRealize Log Insight cluster, declared
the leader for that service. The current leader is denoted by the text (ILB) next to the node.

Query the Results of In-Production Cluster Checks

The in-production cluster check service runs a battery of checks periodically at each node. You can query
the latest results of the in-product cluster checks using the CLI.

For example, the service determines if the cluster is running and configured as expected or if there are
any issues with integrations to other systems. Additional checks are listed below.

n Is NTP configured in a multi-host deployment?

n Can the Active Directory be reached (if it is currently configured)?

n Can Active Directory authentication occur (if it is currently configured)?

n Can the Active Directory hosts and Kerberos hosts be reached (if Active Directory is currently
configured)?

n Is the system running in a non-supported two-host deployment?

n Is there enough space in /tmp to perform an upgrade?

n Is there enough space in /storage/core to perform an upgrade?

n Is localhost correctly placed inside /etc/hosts?

Procedure

1 At the command line, establish an SSH connection to the vRealize Log Insight virtual appliance and
log in as the root user.

2 In the command line, type /usr/lib/loginsight/application/sbin/[Link]

and press Enter.

VMware, Inc. 68
 6
Ports and External Interfaces

vRealize Log Insight uses specific required services, ports, and external interfaces.

Communication Ports
vRealize Log Insight uses the communication ports and protocols listed in this topic. The required ports
are organized based on whether they are required for sources, for the user interface, between clusters,
for external services, or whether they can be safely blocked by a firewall. Some ports are used only if you
enable the corresponding integration.

Note vRealize Log Insight does not support WAN clustering (also called geo-clustering, high-availability
clustering, or remote clustering). All nodes in the cluster should be deployed in the same Layer 2 LAN. In
addition, the ports described in this section must be opened between nodes for proper communication.

vRealize Log Insight network traffic has several sources.

Admin Workstation

The machine that a system administrator uses to manage the vRealize Log Insight virtual appliance
remotely.

User Workstation

The machine on which a vRealize Log Insight user uses a browser to access the Web interface of
vRealize Log Insight.

System sending logs

The endpoint that sends logs to vRealize Log Insight for analysis and search. For example, endpoints
include ESXi hosts, virtual machines or any system with an IP address.

Log Insight Agents

The agent that resides on a Windows or Linux machine and sends operating system events and logs
to vRealize Log Insight over APIs.

vRealize Log Insight appliance

VMware, Inc. 69
Administering vRealize Log Insight

Any vRealize Log Insight virtual appliance, master or worker, where the vRealize Log Insight services
reside. The base operating system of the appliance is SUSE 11 SP3.

Ports Required for Sources Sending Data

The following ports must be open to network traffic from sources that send data to vRealize Log Insight,
both for connections from outside the cluster and connections load-balanced between cluster nodes.

Source Destination Port Protocol Service Description

System sending logs vRealize Log Insight 514 TCP, UDP Outbound syslog traffic
appliance configured as a
Forwarder destination

System sending logs vRealize Log Insight 1514, 6514 TCP Syslog data over SSL
appliance

vRealize Log Insight vRealize Log Insight 9000 TCP Log Insight Ingestion
Agents appliance API

vRealize Log Insight vRealize Log Insight 9543 TCP Log Insight Ingestion
Agents appliance API over SSL

Ports Required for the User Interface

The following ports must be open to network traffic that needs to use the vRealize Log Insight user
interface, both for connections outside the cluster and connections load-balanced between cluster nodes.

Source Destination Port Protocol Service Description

Admin Workstation vRealize Log Insight 22 TCP SSH: Secure Shell

appliance connectivity

User Workstation vRealize Log Insight 80 TCP HTTP: Web interface

appliance

User Workstation vRealize Log Insight 443 TCP HTTPS: Web interface
appliance

Ports Required Between Cluster Nodes

The following ports should only be open on a vRealize Log Insight master node for network access from
worker nodes for maximum security. These ports are in addition to those ports used for sources and UI
traffic that are load-balanced between cluster nodes.

Source Destination Port Protocol Service Description

vRealize Log Insight vRealize Log Insight 7000 TCP Cassandra replication
appliance appliance and query

vRealize Log Insight vRealize Log Insight 9042 TCP Cassandra service for
appliance appliance native protocol clients

VMware, Inc. 70
Administering vRealize Log Insight

Source Destination Port Protocol Service Description

vRealize Log Insight vRealize Log Insight 9160 TCP Cassandra service for
appliance appliance Thrift clients

vRealize Log Insight vRealize Log Insight 59778, 16520–16580 TCP vRealize Log Insight
appliance appliance Thrift service

Ports Required for External Services

The following ports must be open for outbound network traffic from vRealize Log Insight cluster nodes to
remote services.

Source Destination Port Protocol Service Description

vRealize Log Insight NTP server 123 UDP NTPD: Provides NTP
appliance time synchronization

Note The port is open

only if you select to use
NTP time
synchronization.

vRealize Log Insight Mail Server 25 TCP SMTP: mail service for
appliance outbound alerts

vRealize Log Insight Mail Server 465 TCP SMTPS: mail service
appliance over SSL for outbound
alerts

vRealize Log Insight DNS server 53 TCP, UDP DNS: name resolution
appliance service

vRealize Log Insight AD server 389 TCP, UDP Active Directory

appliance

vRealize Log Insight AD server 636 TCP Active Directory over

appliance SSL

vRealize Log Insight AD server 3268 TCP Active Directory Global

appliance Catalog

vRealize Log Insight AD server 3269 TCP Active Directory Global

appliance Catalog SSL

vRealize Log Insight AD server 88 TCP, UDP Kerberos

appliance

vRealize Log Insight vCenter Server 443 TCP vCenter Server Web
appliance Service

vRealize Log Insight vRealize Operations 443 TCP vRealize Operations

appliance Manager appliance Web service

vRealize Log Insight Third-party log 514 TCP, UDP syslog data
appliance manager

VMware, Inc. 71
Administering vRealize Log Insight

Source Destination Port Protocol Service Description

vRealize Log Insight Third-party log 9000 CFAPI Outbound Log Insight
appliance manager Ingestion API (CFAPI)
traffic configured as a
Forwarder destination

vRealize Log Insight Third-party log 9543 CFAPI Outbound Log Insight
appliance manager Ingestion API (CFAPI)
traffic configured as a
Forwarder destination
with encryption (SSL/
TLS)

Ports That Can Be Blocked

The following ports are open but not used by vRealize Log Insight. These ports can be safely blocked by
a firewall.

Destination Port Protocol Service Description

vRealize Log Insight appliance 111 TCP, UDP RPCbind service that converts
RPC program numbers into
universal addresses.

vRealize Log Insight appliance 9007 TCP Tomcat services

Tomcat service

VMware, Inc. 72
 7
Monitor the Status of the
vRealize Log Insight Agents

You can monitor the status of the vRealize Log Insight Windows and Linux agents and view current
statistics about their operation.

Only those agents that are configured to send data through CFAPI appear on the Agents page. Agents
that are configured to send data through syslog appear on the Hosts page, as with other syslog sources.
If protocol changes from CFAPI to syslog, stats are not updated and represented on the Statistics page
and Agent status is shown as "disconnected". Data represented there is being sent from LI Agents every
30 sec. vRealize Log Insight can display information for up to 15,000 agents.

If you change protocol from CFAPI to syslog, statistics cease to be updated and represented on the Agent
page anymore and agent status is shown as disconnected. Data represented there is being sent from
vRealize Log Insight agent every thirty seconds.

Note If you change a host IP for a vRealize Log Insight server in agent configuration, the agent resets
page stats to zero.

Prerequisites

Verify that you are logged in to the vRealize Log Insight Web user interface as a user with the View
Admin permission. The URL format is [Link] where log-insight-host is the IP address or
host name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

VMware, Inc. 73
Administering vRealize Log Insight

2 Under Management, click Agents.

Status information for each agent that sends data with CFAPI appears.

What to do next

You can use the information from the Agents page to monitor the operation of the installed vRealize Log
Insight Windows and Linux agents. Click the agent hostname to go to the Interactive Analytics page for
that host. After setting the hostname parameter from the LI Agent, and if default CFAPI proto is used and
points to a Log Insight instance, you can monitor the connection by opening the Agents statistics page
and verifying that the agent appears in the list of agents. You can use the links under the hostname
column to navigate to the Insight Agents page and check the logs coming from the mentioned Agent.

VMware, Inc. 74
 8
Enable Agent Auto-Update from
the Server

You can enable auto-update for all agents from the vRealize Log Insight server.

Auto-update applies the latest available update to all agents connected to the server. You can disable the
auto-update feature for individual servers by editing the agent's [Link] file. For more information,
see Working with vRealize Log Insight Agents.

Auto-update is disabled for the server by default.

Prerequisites

Agents must have an active status and be version 4.3 or later.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Click Agents from the menu on the left.

3 Click the toggle control for Enable Auto-update for all agents on the Agents page.

Results

Agents connected to this server are updated when an update is present.

VMware, Inc. 75
 9
Centralized Agent
Configurations and Agent
Groups

Using the vRealize Log Insight server, you can configure agents from within the application's user
interface. Agents poll the vRealize Log Insight server regularly to determine if new configurations are
available.

You can group agents that require the same configuration. For example, you might group all vRealize Log
Insight Windows agents separately from the vRealize Log Insight Linux agents.

In the All Agents menu, existing agent groups from content packs are listed automatically. The agents
listed relate to content packs that you have already installed (for example the vSphere content pack),
which use agent groups. All user-created agent groups appear under Content Packs > Custom
Content, when you click My Content or Shared Content.

A user with at least a view-only admin role can export content packs with the agent group templates.

Note
n You cannot use the same content pack template more than once.

n Content pack groups are read-only.

Only configuration sections beginning with [winlog], [filelog], and [parser] are used in content
packs. Additional sections are not exported as part of a content pack. Only single-line comments (lines
beginning with ; ) under the [winlog], [filelog], and [parser] sections, are preserved in a content
pack.

Note A single agent can belong to multiple agent groups and inherits all the settings from the centralized
agent configuration.

You can create a configuration for the All Agents group as described in Create an Agent Group. If an
agent is configured from the combination of a centralized agent configuration and another configuration,
the agent configuration is a result of merging both the configurations. For more information about
merging, see Agent Group Configuration Merging.

Note Use agent groups whenever possible, and avoid using the All Agents configuration unless needed.

VMware, Inc. 76
Administering vRealize Log Insight

See Working with vRealize Log Insight Agents for information about configuring agents and merging local
and server-side configurations.

n Agent Group Configuration Merging

With agent groups, agents can be part of multiple groups and they can belong to the default group
All Agents—enabling centralized configuration.

n Create an Agent Group

You can create a group of agents that are configured with the same parameters.

n Edit an Agent Group

You can edit the name and description of an agent group, change the filters, and edit the
configuration.

n Add a Content Pack Agent Group as an Agent Group

You can add an agent group that was defined as part of a content pack to your active groups and
apply an agent configuration to the group.

n Delete an Agent Group

You can delete an agent group to remove it from the active groups list.

Agent Group Configuration Merging

With agent groups, agents can be part of multiple groups and they can belong to the default group All
Agents—enabling centralized configuration.

Merging occurs server-side—and the resulting configuration is merged with the agent-side configuration.
The merged configuration is a result of the following rules.

n The individual group configurations have a higher priority and overrides the All Agents group settings.

n The All Agents group configuration overrides the local configuration.

n You cannot configure sections with the same name in different groups except with the All Agents
groups. However, the sections in individual groups have a higher priority.

Note To prevent agent loss, the hostname and port parameters of an agent configuration cannot be
changed centrally from the server.

The merged configuration is stored in the agent-side [Link] file. For windows
systems, this file is stored in %ProgramData%\VMware\Log Insight Agent and for Linux systems it is
stored in /var/lib/loginsight-agent/.

Create an Agent Group

You can create a group of agents that are configured with the same parameters.

VMware, Inc. 77
Administering vRealize Log Insight

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Agents.

3 In the All Agents menu, Open the drop-down menu in the agent name field next to the Refresh
button and click New Group.

4 Provide a unique name and a description for the agent group and click New Group.

The agent group is created and appears in the All Agents list, but is not saved.

5 Specify one or more filters for the agent group. To create a filter, specify a field name, an operator,
and a value.

Filters can contain wildcards, such as * and ?. For example, you can select the OS filter contains and
specify the value windows to identify all your Windows agents for configuration.
a Choose one of the following fields to filter on:

n IP address

n hostname

n version

n OS

b Select an operator from the drop-down menu and specify a value.

Operator Description

matches Finds strings that match the specified string and wildcard specification, where *
means zero or more characters and ? means any single character. Prefix and
postfix globbing is supported.
For example, *test* matches strings such as test123 or my-test-run.

does not match Excludes strings that match the specified string and wildcard specification,
where * means zero or more characters and ? means any single character.
Prefix and postfix globbing is supported.
For example, test* filters out test123, but does not exclude mytest123.
%test* does not filters out test123, but does exclude xtest123

starts with Finds strings that start with the specified character string.
For example, test finds test123 or test, but not my-test123.

does not start with Excludes strings that start with the specified character string.
For example, test filters out test123, but not my-test123.

6 Specify the agent configuration values in the Agent Configuration area and click Save New Group.

VMware, Inc. 78
Administering vRealize Log Insight

Results

The agent configuration is applied after the next polling interval.

Edit an Agent Group

You can edit the name and description of an agent group, change the filters, and edit the configuration.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Agents.

3 In the All Agents menu, select the name of the appropriate agent group and click the pencil icon to
edit it.

4 Make your changes.

Item to Edit Action

Name or Description Make the necessary changes and click Save.

Filters or Configuration Make the necessary changes and click Save Group.

Add a Content Pack Agent Group as an Agent Group

You can add an agent group that was defined as part of a content pack to your active groups and apply
an agent configuration to the group.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Agents.

3 In the All Agents menu, select an agent template for the Available Templates list.

4 Click Copy Template to copy the content pack agent group to your active groups.

5 Click Copy.

VMware, Inc. 79
Administering vRealize Log Insight

6 Select the required filters and click Save new group.

Results

The content pack agent group is added to the active groups and the agents are configured according to
the filters that you specified.

Delete an Agent Group

You can delete an agent group to remove it from the active groups list.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Agents.

3 In the All Agents menu, select the name of the agent group to delete, by clicking the X icon next to
its name.

4 Click Delete.

Results

The agent group is removed from the active groups.

VMware, Inc. 80
 10
Monitoring vRealize Log Insight

You can monitor the vRealize Log Insight virtual appliance and the hosts and devices that send log events
to vRealize Log Insight.

This chapter includes the following topics:

n Check the Health of the vRealize Log Insight Virtual Appliance

n Monitor Hosts That Send Log Events

n Configure a System Notification to Report on Inactive Hosts

Check the Health of the vRealize Log Insight Virtual

Appliance
You can check available resources and active queries on the vRealize Log Insight virtual appliance, and
view current statistics about the operation of vRealize Log Insight.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click System Monitor.

3 If vRealize Log Insight is running as a cluster, click Show resources for and choose the node you
want to monitor.

VMware, Inc. 81
Administering vRealize Log Insight

4 Click the buttons on the System Monitor page to view the information that you need.

Option Description

Resources View information about the CPU, memory, IOPS (read and write activity), and
storage usage on the vRealize Log Insight virtual appliance.
The charts on the right represent historical data for the last 24 hours, and are
refreshed at five-minute intervals. The charts on the left display information for the
last five minutes, and are refreshed every three seconds.

Active Queries View information about the queries that are currently active in vRealize Log Insight.

Statistics View statistics about the log ingest operations and rates.
To view more detailed statistics, click Show advanced statistics.

What to do next

You can use the information from the System Monitor page to manage resources on the vRealize Log
Insight virtual appliance.

Monitor Hosts That Send Log Events

You can view a list of all hosts and devices that send log events to vRealize Log Insight and monitor
them.

Entries in host tables expire three months after the last ingested event.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Hosts.

Note If you have configured a vCenter Server to send events and alarms, but have not configured
the individual ESXi hosts to send logs, the Hostname column lists both the vCenter Server and the
individual ESXi hosts as the source instead of listing just the vCenter Server.

What to do next

Users with administrator privileges can set up a system notification that is sent when hosts have been
inactive. For more information, see Configure a System Notification to Report on Inactive Hosts.

VMware, Inc. 82
Administering vRealize Log Insight

Configure a System Notification to Report on Inactive

Hosts
vRealize Log Insight includes a built-in notification that you can use to learn about which hosts have been
inactive for a specified period of time.

You enable the notification from the Hosts screen and specify a threshold that triggers the notification.
You can apply this to all hosts or to smaller list of hosts.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin
permission. The URL format is [Link] where log-insight-host is the IP address or host
name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Management, click Hosts.

Note If you have configured a vCenter Server to send events and alarms, but have not configured
the individual ESXi hosts to send logs, the Hostname column lists both the vCenter Server and the
individual ESXi hosts as the source instead of listing just the vCenter Server.

3 Select Inactive hosts notification on the Hosts page to display a form for configuring when and for
which hosts the notification should be sent.

4 Specify how long the host should be inactive before sending a notification.

Values can range from 10 minutes to the maximum of the host Time to Live (TTL) period, for which
the default is three months.
For example

Send alert listing hosts that are inactive for 8 hours of last received event.

VMware, Inc. 83
Administering vRealize Log Insight

5 You control which hosts are monitored for notification with the Inactive hosts notification whitelist
setting. When this setting is not selected, notifications are sent for all inactive hosts.

n To have notifications sent for all inactive hosts, clear the check box.

n To have notifications sent for only some inactive hosts, select Inactive hosts notification
whitelist and specify the host names in a comma-separated list.

6 Click Save.

Results

System notifications are sent to the address specified on the Configuration>SMTP Server page when a
host is inactive for longer than the specified limit.

VMware, Inc. 84
 11
Integrating vRealize Log Insight
with VMware Products

vRealize Log Insight can integrate with other VMware products to use events and log data, and to provide
better visibility into events that occur in a virtual environment.

Integration with VMware vSphere

vRealize Log Insight Administrator users can set up vRealize Log Insight to connect to vCenter Server
systems at two-minute intervals, and collect events, alarms, and tasks data from these vCenter Server
systems. In addition, vRealize Log Insight can configure ESXi hosts via vCenter Server. See Connect
vRealize Log Insight to a vSphere Environment.

Integration with VMware vRealize Operations Manager

You can integrate vRealize Log Insight with vRealize Operations Manager vApp and vRealize Operations
Manager Installable. Integrating with the Installable version requires additional changes to the vRealize
Operations Manager configuration. For information about configuring vRealize Operations Manager
Installable to integrate with vRealize Log Insight, see the Log Insight Getting Started Guide.

vRealize Log Insight and vRealize Operations Manager can be integrated in two independent ways.

Notification Events

vRealize Log Insight Administrator users can set up vRealize Log Insight to send notification events
to vRealize Operations Manager based on queries that you create. See Configure vRealize Log
Insight to Send Notification Events to vRealize Operations Manager.

Launch in Context

Launch in context is a feature in vRealize Operations Manager that lets you launch an external
application via URL in a specific context. The context is defined by the active UI element and object
selection. Launch in context lets the vRealize Log Insight adapter add menu items to a number of
different views within the Custom user interface and the vSphere user interface of vRealize

VMware, Inc. 85
Administering vRealize Log Insight

Operations Manager. See Enable Launch in Context for vRealize Log Insight in vRealize Operations
Manager.

Note Notification events do not depend on the launch in context configuration. You can send notification
events from vRealize Log Insight to vRealize Operations Manager even if you do not enable the launch in
context feature.

If the environment changes, vRealize Log Insight administrator users can change, add, or remove
vSphere systems from vRealize Log Insight, change or remove the instance of vRealize Operations
Manager to which alert notifications are sent, and change the passwords that are used to connect to
vSphere systems and vRealize Operations Manager.

This chapter includes the following topics:

n Connect vRealize Log Insight to a vSphere Environment

n Configure vRealize Log Insight to Pull Events, Tasks, and Alarms from vCenter Server Instance

n Using vRealize Operations Manager with vRealize Log Insight

n vRealize Operations Manager Content Pack for vRealize Log Insight

Connect vRealize Log Insight to a vSphere Environment

Before you configure vRealize Log Insight to collect alarms, events, and tasks data from your vSphere
environment, you must connect vRealize Log Insight to one or more vCenter Server systems.

vRealize Log Insight can collect two types of data from vCenter Server instances and the ESXi hosts that
they manage.

n Events, tasks, and alerts are structured data with specific meaning. If configured,vRealize Log Insight
pulls events, tasks, and alerts from the registered vCenter Server instances.

n Logs contain unstructured data that can be analyzed in vRealize Log Insight. ESXi hosts or vCenter
Server Appliance instances can push their logs to vRealize Log Insight through syslog.

VMware, Inc. 86
Administering vRealize Log Insight

Prerequisites

n For the level of integration that you want to achieve, verify that you have user credentials with enough
privileges to perform the necessary configuration on the vCenter Server system and its ESXi hosts.

Level of Integration Required Privileges

Events, tasks, and alarms n [Link]

collection
Note [Link] is a system-defined privilege. When you add a custom role and do
not assign any privileges to it, the role is created as a Read Only role with three system-
defined privileges: [Link], [Link], and [Link].

Syslog configuration on ESXi n [Link] settings

hosts n [Link] configuration
n [Link] Settings
n [Link] profile and firewall

Note You must configure the permission on the top-level folder within the vCenter Server inventory,
and verify that the Propagate to children check box is selected.

n Verify that you know the IP address or domain name of the vCenter Server system.

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Integration, click vSphere.

3 Type the IP address and credentials for a vCenter Server, and click Test Connection.

It is recommended that you use service account credentials.

4 (Optional) To register another vCenter Server, click Add vCenter Server and repeat steps 3 through
5.

Note Do not register vCenter Server systems with duplicate names or IP addresses. vRealize Log
Insight does not check for duplicate vCenter Server names. You must verify that the list of registered
vCenter Server systems does not contain duplicate entries.

5 Click Save.

What to do next

n Start collecting events, tasks, and alarms data from the vCenter Server instance that you registered.
See Configure vRealize Log Insight to Pull Events, Tasks, and Alarms from vCenter Server Instance.

n Start collecting syslog feeds from the ESXi hosts that the vCenter Server manages. See Configure an
ESXi Host to Forward Log Events to vRealize Log Insight.

VMware, Inc. 87
Administering vRealize Log Insight

vRealize Log Insight as a Syslog Server

vRealize Log Insight includes a built-in syslog server that is constantly active when the vRealize Log
Insight service is running.

The syslog server listens on ports 514/TCP, 1514/TCP, and 514/UDP, and is ready to ingest log
messages that are sent from other hosts. Messages that are ingested by the syslog server become
searchable in the vRealize Log Insight web user interface near real time. The maximum syslog message
length that vRealize Log Insight accepts is 10 KB.

Syslog formats RFC-6587, RFC-5424, and RFC-3164 are supported.

Configure an ESXi Host to Forward Log Events to vRealize Log

Insight
ESXi hosts or vCenter Server Appliance instances generate unstructured log data that can be analyzed in
vRealize Log Insight.

You use the vRealize Log Insight Administration interface to configure ESXi hosts on a registered vCenter
Server to push syslog data to vRealize Log Insight.

Caution Running parallel configuration tasks might result in incorrect syslog settings on the target ESXi
hosts. Verify that no other administrative user is configuring the ESXi hosts that you intend to configure.

A vRealize Log Insight cluster can use an integrated load balancer to distribute ESXi and vCenter Server
Appliance syslog feeds between the individual nodes of the cluster.

For information on filtering syslog messages on ESXi hosts before messages are sent to vRealize Log
Insight, see the Configure Log Filtering on ESXi Hosts topic in the Setting Up ESXi section, of the
vSphere Installation and Setup guide.

For information on configuring syslog feeds from a vCenter Server Appliance, see Configure vCenter
Server to Forward Log Events to vRealize Log Insight.

Note vRealize Log Insight can receive syslog data from ESXi hosts version 5.5 and later.

Prerequisites

n Verify that the vCenter Server that manages the ESXi host is registered with your vRealize Log
Insight instance. Or, you can register the ESXi host and configure vCenter Server in a single
operation.

n Verify that you have user credentials with enough privileges to configure syslog on ESXi hosts.

n [Link] settings

n [Link] profile and firewall

Note You must configure the permission on the top-level folder within the vCenter Server inventory,
and verify that the Propagate to children check box is selected.

VMware, Inc. 88
Administering vRealize Log Insight

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Integration, click vSphere.

3 In the vCenter Server table, locate the vCenter Server instance that manages the ESXi host from
which you want to receive syslog feeds and click Edit.

4 Select the Configure ESXi hosts to send logs to Log Insight check box in the opened edit view.

By default, vRealize Log Insight configures all reachable ESXi hosts of version 5.5 and later to send
their logs through UDP.

5 (Optional) To modify the default configuration values, click Advanced Options.

n To change the protocol for all ESXi hosts, select Configure all ESXi hosts, select a protocol, and
click OK.

n To set up specific ESX hosts logging only or to change the protocol for selected ESXi hosts, use
the following steps:

a Select Configure specific ESXi hosts.

b Select one or more hosts from the Filter by host list.

c Set protocol value.

d Click OK.

6 (Optional) If you are using clusters, open the drop-down menu for the Target text box and select the
hostname or IP address for the load balancer that distributes syslog feeds.

7 Click Save.

What to do next

The ESXi host configurations are shown in the ESXi hosts configured column of the vCenter Server table.
If the hosts are configured, you can click View details in the hosts configured column to view detailed
information for the configured ESXi hosts.

Modify an ESXi Host Configuration for Forwarding Log Events to

vRealize Log Insight
ESXi hosts or vCenter Server Appliance instances generate unstructured log data that can be analyzed in
vRealize Log Insight.

You use the vRealize Log Insight Administration interface to configure ESXi hosts on a registered vCenter
Server to push syslog data to vRealize Log Insight.

Caution Running parallel configuration tasks might result in incorrect syslog settings on the target ESXi
hosts. Verify that no other administrative user is configuring the ESXi hosts that you intend to configure.

VMware, Inc. 89
Administering vRealize Log Insight

After the initial configuration is set up, you can enable an option to periodically look for and automatically
configure both existing and newly added vSphere ESXi hosts that are not configured yet. The currently
configured protocol is used to configure the ESXi hosts automatically.

A vRealize Log Insight cluster can use an integrated load balancer to distribute ESXi and vCenter Server
Appliance syslog feeds between the individual nodes of the cluster.

For information on filtering syslog messages on ESXi hosts before configured messages are sent to
vRealize Log Insight, see the Configure Log Filtering on ESXi Hosts topic in the Setting Up ESXi section,
of the vSphere Installation and Setup guide.

For information on configuring syslog feeds from a vCenter Server Appliance, see Configure vCenter
Server to Forward Log Events to vRealize Log Insight.

vRealize Log Insight can receive syslog data from ESXi hosts version 5.5 and later.

Prerequisites

n Verify that the vCenter Server that manages the ESXi host is registered with your vRealize Log
Insight instance.

n Verify that you have user credentials with enough privileges to configure syslog on ESXi hosts.

n [Link] settings

n [Link] profile and firewall

Note You must configure the permission on the top-level folder within the vCenter Server inventory,
and verify that the Propagate to children check box is selected.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Integration, click vSphere.

3 Select the Configure ESXi hosts to send logs to Log Insight check box.

4 Click Advanced Options.

5 To change the protocol for selected ESXi hosts, use the following steps:

a Select one or more hosts from the Filter by host list.

b Verify that the current protocol is what you want, or select another protocol.

c To enable the automatic configuration of ESXi hosts with the currently configured protocol, select
Automatically configure all ESXi hosts. When enabled, vRealize Log Insight periodically looks
for and configures both existing and newly added vSphere ESXi hosts that are not configured yet.

d Click Configure to begin the configuration of the selected hosts. The ESXi dialog box closes.

e Click OK in the message dialog box.

f If you changed the protocol setting, click Save in the main window after you close the ESXi
configuration dialog box.

VMware, Inc. 90
Administering vRealize Log Insight

6 (Optional) If you are using clusters, you can specify a load balancer by opening the drop-down menu
for the Target text box on the vSphere Integration page and selecting the hostname or IP address
for the load balancer.

vRealize Log Insight Notification Events in vRealize Operations

Manager
You can configure vRealize Log Insight to send notification events to vRealize Operations Manager based
on the alert queries that you create.

When you configure a notification alert in vRealize Log Insight, you select a resource in vRealize
Operations Manager that is associated with the notification events. See Add an Alert Query in Log Insight
to Send Notification Events to vRealize Operations Manager.

Listed below are sections of the vRealize Operations Manager UI where notification Events appear.

n Home > Recommendations dashboard > Top Health Alerts For Descendants widget

n Home > Alerts Tab

n On all Custom Dashboards that include widgets with notification events

For additional information on where notification events appear, see the VMware vRealize Operations
Manager Documentation Center.

Configure vCenter Server to Forward Log Events to vRealize Log Insight

The vSphere Integration collects task and events from vCenter Server, but not the low-level internal logs
from each vCenter Server component. These logs are used by the vSphere Content Pack.

Configuration for vCenter Server 6.5 and later releases should be done through the vCenter Server
Appliance Management Interface. For more information about how to forward log events from vCenter
Server, see vSphere documentation about redirecting vCenter Server Appliance log files to another
machine.

For earlier versions of vSphere, although the vCenter Server Appliance does contain a syslog daemon
that could be used to route logs, the preferred method is to install a vRealize Log Insight agent.

For information about installing vRealize Log Insight agents, see Working with vRealize Log Insight
Agents.

The vSphere content pack contains agent groups defining specific log files to collect from vCenter Server
installations. The configuration is visible at [Link]
contentPackId=[Link].

For information about working with agent groups, see Chapter 9 Centralized Agent Configurations and
Agent Groups

For information about vCenter Server log file locations, see [Link] and
[Link]

VMware, Inc. 91
Administering vRealize Log Insight

Configure vRealize Log Insight to Pull Events, Tasks, and

Alarms from vCenter Server Instance
Events, tasks, and alerts are structured data with specific meaning. You can configure vRealize Log
Insight to collect alarms, events, and tasks data from one or more vCenter Server systems.

You use the Administration UI to configure vRealize Log Insight to connect to vCenter Server systems.
The information is pulled from the vCenter Server systems by using the vSphere Web Services API and
appears as a vSphere content pack in the vRealize Log Insight web user interface.

Note that vSphere 6.5 has a new native high availability solution. For more information on HA and the use
of load balancers, see the white paper What's New in VMware vSphere 6.5 available on
[Link].

Note vRealize Log Insight can pull alarms, events, and tasks data only from vCenter Server 5.5 and
later.

Prerequisites

Verify that you have user credentials with [Link] privileges.

Note You must configure the permission on the top-level folder within the vCenter Server inventory, and
verify that the Propagate to children check box is selected.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Integration, click vSphere.

3 In the vCenter Server table, locate the vCenter Server instance from which you want to collect data.

4 Select the Collect vCenter Server events, tasks, and alarms check box in the opened edit view.

5 Click Save.

Results

vRealize Log Insight connects to the vCenter Server every two minutes and ingests all new information
since the last successful poll.

What to do next

n Analyze vSphere events using the vSphere content pack or custom queries.

n Enable vSphere content pack alerts or custom alerts.

Using vRealize Operations Manager with vRealize Log

Insight

VMware, Inc. 92
Administering vRealize Log Insight

Requirements for Integrating With vRealize Operations Manager

As part of integrating vRealize Log Insight with vRealize Operations Manager, you must specify
credentials for vRealize Log Insight to authenticate against vRealize Operations Manager.

vRealize Operations Manager supports both local user accounts and multiple LDAP sources. Both the
vRealize Operations Manager and VMware Identity Manager integrations are configured by the vRealize
Log Insight admin.

If your deployment uses a VMware Identity Manager integration in vRealize Log Insight, the VMware
Identity Manager fallback URL (Redirect URL Host) and the target field on the vRealize Operations
Manager integration page should have the exact same value.

Prerequisites

Verify that the integration user account has permissions to manipulate objects in vRealize Operations
Manager. See Minimum Required Permissions for a Local or Active Directory User Account.

Procedure

u To determine the user name for a local user account:

a Select Access Control from the vRealize Operations Manager web interface.

b Identify or create the integration user. The Source Type field is Local User.

c Note the value of the User Name field. You specify this user name when you configure the
integration in the vRealize Log Insight administration user interface.

u To determine the user name format for the LDAP user account that must be provided in vRealize Log
Insight, follow these instructions:

a Select Access Control from the vRealize Operations Manager web interface.

b Identify or create the integration user. Note the User Name and Source Type fields. For
example, a user named integration@[Link] from the source Active Directory - ad.

c Select Authentication Sources.

d Identify the authentication source corresponding to the Source Type from Step b. Note the
Source Display Name field. For example, "ad".

e The user name that entered in the vRealize Log Insight administration user interface is combined
from Step 3 and Step 5, in the form UserName@SourceDisplayName. For example,
integration@[Link]@ad.

Minimum Required Permissions for a Local or Active Directory User Account

To integrate vRealize Log Insight with vRealize Operations Manager, you must specify credentials for
vRealize Log Insight to authenticate against vRealize Operations Manager. To manipulate objects in
vRealize Operations Manager, a user account must have the required permissions.

If you assign permissions to a user for Launch in Context, the user can also configure alert integration.
Use the information in the alert integration table to assign permissions for alert integration only.

VMware, Inc. 93
Administering vRealize Log Insight

Table 11-1. Alert Integration

Action Permissions and Objects to Select

Create a custom role with the listed 1 Administration -> Rest APIs
permissions. a All other, Read, Write APIs
b Read access to APIs

Assign the preceding role to the local or 1 Adapter Instance -> vRealizeOpsMgrAPI [Check All]
Active Directory user (new or existing) 2 vSphere Hosts and Clusters [Check All]
and select objects/object hierarchies to 3 vSphere Networking [Check All]
assign.
4 vSphere Storage [Check All]

Table 11-2. Launch in Context Integration

Action Permissions and Objects to Select

Create a custom role with the listed permissions. 1 Administration -> Rest APIs
a All other, Read, Write APIs
b Read access to APIs
c Delete resource
2 Administration -> Configuration -> Manage Resource
Relationships
3 Administration -> Resource Kind Management
a Create
b Edit
4 Administration -> Resource Management
a Create
b Delete
c Read
5 Administration -> Access -> Access Control -> Add, Edit, or
Delete a Role.

Note This permission is required for vRealize Operations

Manager versions 7.0 and earlier.

Assign the preceding role to the local or Active Directory user Select Allow Access to All Objects in the System.
(new or existing) and select objects/object hierarchies to assign.

Configure vRealize Log Insight to Send Notification Events to

vRealize Operations Manager
You can configure vRealize Log Insight to send alert notifications to vRealize Operations Manager.

You can integrate vRealize Log Insight with vRealize Operations Manager vApp and vRealize Operations
Manager Installable. Integrating with the Installable version requires additional changes to the vRealize
Operations Manager configuration. For information about configuring vRealize Operations Manager
Installable to integrate with vRealize Log Insight, see the Log Insight Getting Started Guide.

Integrating vRealize Log Insight alerts with vRealize Operations Manager allows you to view all
information about your environment in a single user interface.

VMware, Inc. 94
Administering vRealize Log Insight

You can send notification events from multiple vRealize Log Insight instances to a single vRealize
Operations Manager instance. You can enable launch in context for a single vRealize Log Insight instance
per vRealize Operations Manager instance.

vRealize Log Insight uses the vRealize Operations Manager REST API to create resources and
relationships in vRealize Operations Manager for configuring the launch-in-context adapter.

Prerequisites

n Create an integration user account in vRealize Operations Manager with required permissions. For
more information, see Requirements for Integrating With vRealize Operations Manager.

n Verify that you know the IP address or host name of the target vRealize Operations Manager
instance.

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

Note In an environment running a vRealize Operations Manager cluster with a configured load balancer,
you can use the load balancer IP address if one is available.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Integration, select vRealize Operations Manager.

3 Type the IP address or host name of the master node or the load balancer if one is configured. Use a
vRealize Operations Manager user credential and click Test Connection. vRealize Log Insight uses
the credentials to push notification events to vRealize Operations Manager. Make sure that the
configured user has the minimum permissions required for the integration to work. See Minimum
Required Permissions for a Local or Active Directory User Account.

4 In the vRealize Operations Manager pane, select Enable alerts integration.

5 Click Save.

What to do next

n See relevant pages in the vRealize Operations Manager UI to view the notification events that
vRealize Log Insight sends.

Enable Launch in Context for vRealize Log Insight in vRealize

Operations Manager
You can configure vRealize Operations Manager to display menu items related to vRealize Log Insight
and launch vRealize Log Insight with an object-specific query.

You can integrate vRealize Log Insight with vRealize Operations Manager vApp and vRealize Operations
Manager Installable.

VMware, Inc. 95
Administering vRealize Log Insight

Integrating with vApp install and Installable (Windows, Linux) requires additional changes to the vRealize
Operations Manager configuration. See the topic about installing the vRealize Log Insight Management
Pack (Adapter) in vRealize Operations Manager 6.x and later in the vRealize Log Insight 4.0
documentation center.

Note that the vRealize Log Insight Management Pack is pre-installed in vRealize Operations Manager 6.0
and later and does not require configuration changes.

vRealize Operations Manager Installable (Windows version) is discontinued from vRealize Operations
Manager 6.5 and later.

Important One instance of vRealize Operations Manager supports launch in context for only one
instance of vRealize Log Insight. Because vRealize Log Insight does not check whether other instances
are already registered with vRealize Operations Manager, you might override the settings of another user.

Prerequisites

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

n Verify that you know the IP address or host name of the target vRealize Operations Manager
instance.

n Verify that you have the required user credentials. See Minimum Required Permissions for a Local or
Active Directory User Account.

n If you are using vRealize Operations Manager 6.5 or later, use the procedure for enabling launch in
context in the vRealize Operations Manager 6.5 information center.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Integration, select vRealize Operations Manager.

3 Type the IP address or FQDN of the vRealize Operations Manager master node or load balancer if
one is configured and click Test Connection.

Note For Launch in Context functionality, you must provide a vRealize Operations Manager user
with administrator privileges.

4 Click Save.

Results

vRealize Log Insight configures the vRealize Operations Manager instance. This operation might take a
few minutes.

Items related to vRealize Log Insight appear in the menus of vRealize Operations Manager.

VMware, Inc. 96
Administering vRealize Log Insight

What to do next

Launch a vRealize Log Insight query from the vRealize Operations Manager instance. See vRealize Log
Insight Launch in Context

vRealize Log Insight Launch in Context

When you enable launch in context for vRealize Log Insight, a vRealize Log Insight resource is created in
vRealize Operations Manager.

The resource identifier contains the IP address of the vRealize Log Insight instance, and is used by
vRealize Operations Manager to open vRealize Log Insight.

Launch in Context in vRealize Operations Manager 6.5 and Later

For information about enabling launch in context, see the vRealize Operations Manager information
center.

Launch in Context in the vSphere User Interface of vRealize Operations Manager 6.4 and
Earlier
The launch in context options that are related to vRealize Log Insight appear in the Actions drop-down
menu of the vSphere user interface. You can use these menu items to open vRealize Log Insight, and
search for log events from an object in vRealize Operations Manager.

The available launch in context action depends on the object that you select in vRealize Operations
Manager inventory. The time range of the queries is limited to 60 minutes before you click a launch in
context option.

Table 11-3. Objects in vRealize Operations Manager UI and Their Corresponding Launch in
Context Options and Actions
Object selected in
vRealize
Operations Launch in Context Option in the Action in vRealize
Manager Actions Drop-Down Menu Operations Manager Action in vRealize Log Insight

World Open vRealize Log Insight Opens vRealize Log Insight. vRealize Log Insight displays the
Interactive Analytics tab.

vCenter Server Open vRealize Log Insight Opens vRealize Log Insight. vRealize Log Insight displays the
Interactive Analytics tab.

Data center Search for logs in vRealize Log Opens vRealize Log Insight vRealize Log Insight displays the
Insight and passes the resource Interactive Analytics tab and
names of all host systems performs a query to find log events
under the selected data that contain names of hosts within
center object. the data center.

Cluster Search for logs in vRealize Log Opens vRealize Log Insight vRealize Log Insight displays the
Insight and passes the resource Interactive Analytics tab and
names of all host systems performs a query to find log events
under the selected Cluster that contain names of hosts within
object. the cluster.

VMware, Inc. 97
Administering vRealize Log Insight

Table 11-3. Objects in vRealize Operations Manager UI and Their Corresponding Launch in
Context Options and Actions (continued)
Object selected in
vRealize
Operations Launch in Context Option in the Action in vRealize
Manager Actions Drop-Down Menu Operations Manager Action in vRealize Log Insight

Host System Search for logs in vRealize Log Opens vRealize Log Insight vRealize Log Insight displays the
Insight and passes the resource Interactive Analytics tab and
name of the selected Host performs a query to find log events
object. that contain the name of the
selected Host system.

Virtual Machine Search for logs in vRealize Log Opens vRealize Log Insight vRealize Log Insight displays the
Insight and passes the IP address Interactive Analytics tab and
of the selected virtual performs a query to find log events
machine and the resource that contain the IP address of the
name of the related host virtual machine, and the name of the
system. host where the virtual machine
resides.

On the Alerts tab, if you select an alert and select Search for logs in Log Insight from the in-context
menu, the time range of the query is limited to one hour before the alert is triggered. For example, if an
alert was triggered at 2:00 PM, the query in vRealize Log Insight displays all log messages that occurred
between 1:00 PM and 2:00 PM. This helps you identify events that might have triggered the alert.

You can open vRealize Log Insight from metric charts in vRealize Operations Manager. The time range of
the query thatvRealize Log Insight runs matches the time range of the metric chart.

Note The time that you see in vRealize Log Insight and vRealize Operations Manager metric charts
might differ if the time setting of the virtual appliances is different.

Launch in Context in the vRealize Operations Manager 6.4 and Earlier User Interface

The launch in context icon appears on several pages of the user interface, but you can launch
vRealize Log Insight only from the pages that display vRealize Log Insight notification events:

n The Alerts Overview page.

n The Alert Summary page of a vRealize Log Insight notification alert.

n The Alerts widgets on your dashboards, when a vRealize Log Insight notification alert is selected.

When you select a vRealize Log Insight notification event in the Custom user interface, you can choose
between two launch in context actions.

VMware, Inc. 98
Administering vRealize Log Insight

Table 11-4. Launch in Context Options and Actions in vRealize Operations Manager UI
Launch in Context Option in vRealize Action in vRealize Operations
Operations Manager Manager Action in vRealize Log Insight

Open vRealize Log Insight Opens vRealize Log Insight. vRealize Log Insight displays the
Dashboards tab and loads the vSphere
Overview dashboard.

Search for Logs in vRealize Log Insight Opens vRealize Log Insight and vRealize Log Insight displays the
passes the ID of the query that Interactive Analytics tab and performs the
triggered the notification event. query that triggered the notification event.

When you select an alert that has not originated from vRealize Log Insight, the launch in context menu
contains the Search for VM and Host Logs in vRealize Log Insight menu item. If you select this menu
item, vRealize Operations Manager opens vRealize Log Insight and passes the identifiers of the object
that triggered the alert. vRealize Log Insight uses the resource identifiers to perform a search in the
available log events.

Two-Way Launch in Context

Launch in Context is also available from vRealize Log Insight to vRealize Operations Manager.

If you integrate vRealize Log Insight with vRealize Operations Manager, you can perform a Launch in
Context from a vRealize Log Insight event by selecting the gear icon to the left of the event and selecting
the option to view in vRealize Operations Manager.

For information about Launch in Context from vRealize Operations Manager to vRealize Log Insight, see
vRealize Log Insight Launch in Context.

Procedure

1 In vRealize Log Insight, navigate to the Interactive Analytics tab.

2 Locate an event that contains inventory mapping fields and hover over the event.

3 Click the gear icon and select Open Analysis in vRealize Operations Manager from the drop-down
menu.

A new browser tab opens directing you to the vRealize Operations Manager instance integrated with
vRealize Log Insight. Once you authenticate, you are directed to the Environment > Analysis
section of vRealize Operations Manager with the object selected.

Note When multiple vRealize Log Insight instances are connected to the same vRealize Operations
Manager instance, only the last vRealize Log Insight instance integrated with vRealize Operations
Manager has the Launch in Context feature. This also means that the Launch in Context feature is
overridden whenever a vRealize Log Insight instance is integrated with a vRealize Operations
Manager instance that was previously integrated with a different vRealize Log Insight instance.

VMware, Inc. 99
Administering vRealize Log Insight

Disable Launch in Context for vRealize Log Insight in vRealize

Operations Manager
You can uninstall the vRealize Log Insight adapter from the vRealize Operations Manager instance to
remove menu items related to vRealize Log Insight from the vRealize Operations Manager user interface.

You use the Administration UI of vRealize Log Insight to disable launch in context. If you do not have
access to vRealize Log Insight or if the vRealize Log Insight instance is deleted before the connection
with vRealize Operations Manager is disabled, you can unregister vRealize Log Insight from the
Administration UI of vRealize Operations Manager. See the Help in the vRealize Operations Manager
Administration portal.

Caution One instance of vRealize Operations Manager supports launch in context for only one instance
of vRealize Log Insight. If another instance of vRealize Log Insight has been registered after you
registered the instance that you want to disable, the second instance overrides the settings of the first one
without notifying you.

Prerequisites

n Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit
Admin permission. The URL format is [Link] where log-insight-host is the IP
address or host name of the vRealize Log Insight virtual appliance.

Procedure

1 Click the configuration drop-down menu icon and select Administration.

2 Under Integration, select vRealize Operations Manager.

3 Deselect the Enable Launch in Context check box.

4 Click Save.

Results

vRealize Log Insight configures the vRealize Operations Manager instance to remove the vRealize Log
Insight adapter. This operation might take a few minutes.

Add a DNS Search Path and Domain

You can add a DNS search path and domain to improve the vRealize Operations Manager inventory
matching.

Adding a DNS search path and domain improves matching when a virtual machine label and search
domain resolve to the IP address of the host that sends log messages to vRealize Log Insight. For
example, if you have a virtual machine named linux_01 in vRealize Operations Manager and the host
name linux_01.[Link] resolves to [Link], then adding a search domain allows vRealize
Log Insight to recognize and match that resource.

VMware, Inc. 100

Administering vRealize Log Insight

Procedure

1 Perform a guest shutdown of the vRealize Log Insight virtual appliance.

2 Once the virtual machine is powered down, select Edit Settings.

3 Select the vApp Options tab.

4 From vApp Options > Authoring, click Properties.

5 Find the [Link].VMware_vCenter_Log_Insight and

[Link].VMware_vCenter_Log_Insight keys.

If the keys do not exist, create them.

For the search path keys, use the following values:

n Category is Networking Properties

n Label is DNS searchpath

n Key class ID is vami

n Key instance ID is VMware_vCenter_Log_Insight.

n Type is Static property, String and User configurable.

For domain keys, use the same values, substituting DNS domain for Label and domain for Key ID.

6 Set the DNS search path and domain. For example, [Link].

7 Power on the virtual appliance.

What to do next

After vRealize Log Insight boots, you can validate the DNS configuration by logging in and viewing the
contents of the /etc/[Link] file. You should see the search and domain options near the end of
the file.

Remove the vRealize Log Insight Adapter

When you enable launch in context on a vRealize Operations Manager 6.2 and later instance, vRealize
Log Insight creates an instance of the vRealize Log Insight adapter on the vRealize Operations Manager
instance.

The instance of the adapter remains in the vRealize Operations Manager instance when you uninstall
vRealize Log Insight. As a result, the launch in context menu items continue to appear in the actions
menus, and point to a vRealize Log Insight instance that no longer exists.

To disable the launch in context functionality in vRealize Operations Manager, you must remove the
vRealize Log Insight adapter from the vRealize Operations Manager instance.

You can use the command line utility cURL to send REST calls to vRealize Operations Manager.

Note These steps are only required if Launch in Context was enabled.

VMware, Inc. 101

Administering vRealize Log Insight

Prerequisites

n Verify that cURL is installed on your system. Note that this tool is preinstalled in the vRealize
Operations Manager virtual appliance and the steps can be performed from the appliance using IP
address [Link].

n Verify that you know the IP address or host name of the target vRealize Operations Manager
instance.

n Depending on the vRealize Operations Manager license that you own, verify that you have the
minimum credentials required to remove the management pack. See Minimum Required Permissions
for a Local or Active Directory User Account.

Procedure

1 In cURL, run the following query on the vRealize Operations Manager virtual appliance to find the
vRealize Log Insight adapter.

curl -k -u "admin" [Link]

LogInsightLogServer/resources

Where admin is the administrator login name and ipaddress is the IP address (or hostname) of the
vRealize Operations Manager instance. You are prompted to enter the password for the user: admin.

From the curl output find the GUID value assigned to the identifier: <ops:resource
creationTime="{TIMESTAMP}" identifier=“{GUID}”>. You can use this GUID value in the
below command that removes the adapter instance.

2 Run the following command to remove the vRealize Log Insight adapter.

curl -k -u "admin" -X DELETE [Link]

Where admin is the administrator login name and ipaddress is the IP address (or hostname) of the
vRealize Operations Manager instance. You are prompted to enter the password for the user: admin.

Results

vRealize Log Insight launch in context items are removed from the menus in vRealize Operations
Manager. For more information about launch in context, see the topic vRealize Log Insight Launch in
Context of the vRealize Log Insight in-product help.

vRealize Operations Manager Content Pack for vRealize

Log Insight
The vRealize Operations Manager content pack for vRealize Log Insight contains dashboards, extracted
fields, saved queries, and alerts that are used to analyze all logs redirected from a vRealize Operations
Manager instance.

VMware, Inc. 102

Administering vRealize Log Insight

The vRealize Operations Manager content pack provides a way to analyze all logs redirected from a
vRealize Operations Manager instance. The content pack contains dashboards, queries, and alerts to
provide diagnostics and troubleshooting capabilities to the vRealize Operations Manager administrator.
The dashboards are grouped according to the major components of vRealize Operations Manager such
as Analytics, UI, and Adapters to provide better manageability. You can enable various alerts to send
notification events in vRealize Operations Manager and emails to administrators.

You can download the vRealize Operations Manager content pack from https://
[Link]/store/loginsight?src=Product_Product_LogInsight_YES_US.

See Working with Content Packs.

VMware, Inc. 103

 12
Security Considerations for
vRealize Log Insight

Use vRealize Log Insight features to safeguard your environment from attack.

This chapter includes the following topics:

n Ports and External Interfaces

n vRealize Log Insight Configuration Files

n vRealize Log Insight Public Key, Certificate, and Keystore

n vRealize Log Insight License and EULA File

n vRealize Log Insight Log Files

n vRealize Log Insight User Accounts

n vRealize Log Insight Firewall Recommendations

n Security Updates and Patches

Ports and External Interfaces

vRealize Log Insight uses specific required services, ports, and external interfaces.

Communication Ports
vRealize Log Insight uses the communication ports and protocols listed in this topic. The required ports
are organized based on whether they are required for sources, for the user interface, between clusters,
for external services, or whether they can be safely blocked by a firewall. Some ports are used only if you
enable the corresponding integration.

Note vRealize Log Insight does not support WAN clustering (also called geo-clustering, high-availability
clustering, or remote clustering). All nodes in the cluster should be deployed in the same Layer 2 LAN. In
addition, the ports described in this section must be opened between nodes for proper communication.

vRealize Log Insight network traffic has several sources.

Admin Workstation

VMware, Inc. 104

Administering vRealize Log Insight

The machine that a system administrator uses to manage the vRealize Log Insight virtual appliance
remotely.

User Workstation

The machine on which a vRealize Log Insight user uses a browser to access the Web interface of
vRealize Log Insight.

System sending logs

The endpoint that sends logs to vRealize Log Insight for analysis and search. For example, endpoints
include ESXi hosts, virtual machines or any system with an IP address.

Log Insight Agents

The agent that resides on a Windows or Linux machine and sends operating system events and logs
to vRealize Log Insight over APIs.

vRealize Log Insight appliance

Any vRealize Log Insight virtual appliance, master or worker, where the vRealize Log Insight services
reside. The base operating system of the appliance is SUSE 11 SP3.

Ports Required for Sources Sending Data

The following ports must be open to network traffic from sources that send data to vRealize Log Insight,
both for connections from outside the cluster and connections load-balanced between cluster nodes.

Source Destination Port Protocol Service Description

System sending logs vRealize Log Insight 514 TCP, UDP Outbound syslog traffic
appliance configured as a
Forwarder destination

System sending logs vRealize Log Insight 1514, 6514 TCP Syslog data over SSL
appliance

vRealize Log Insight vRealize Log Insight 9000 TCP Log Insight Ingestion
Agents appliance API

vRealize Log Insight vRealize Log Insight 9543 TCP Log Insight Ingestion
Agents appliance API over SSL

Ports Required for the User Interface

The following ports must be open to network traffic that needs to use the vRealize Log Insight user
interface, both for connections outside the cluster and connections load-balanced between cluster nodes.

VMware, Inc. 105

Administering vRealize Log Insight

Source Destination Port Protocol Service Description

Admin Workstation vRealize Log Insight 22 TCP SSH: Secure Shell

appliance connectivity

User Workstation vRealize Log Insight 80 TCP HTTP: Web interface

appliance

User Workstation vRealize Log Insight 443 TCP HTTPS: Web interface
appliance

Ports Required Between Cluster Nodes

The following ports should only be open on a vRealize Log Insight master node for network access from
worker nodes for maximum security. These ports are in addition to those ports used for sources and UI
traffic that are load-balanced between cluster nodes.

Source Destination Port Protocol Service Description

vRealize Log Insight vRealize Log Insight 7000 TCP Cassandra replication
appliance appliance and query

vRealize Log Insight vRealize Log Insight 9042 TCP Cassandra service for
appliance appliance native protocol clients

vRealize Log Insight vRealize Log Insight 9160 TCP Cassandra service for
appliance appliance Thrift clients

vRealize Log Insight vRealize Log Insight 59778, 16520–16580 TCP vRealize Log Insight
appliance appliance Thrift service

Ports Required for External Services

The following ports must be open for outbound network traffic from vRealize Log Insight cluster nodes to
remote services.

Source Destination Port Protocol Service Description

vRealize Log Insight NTP server 123 UDP NTPD: Provides NTP
appliance time synchronization

Note The port is open

only if you select to use
NTP time
synchronization.

vRealize Log Insight Mail Server 25 TCP SMTP: mail service for
appliance outbound alerts

vRealize Log Insight Mail Server 465 TCP SMTPS: mail service
appliance over SSL for outbound
alerts

vRealize Log Insight DNS server 53 TCP, UDP DNS: name resolution
appliance service

vRealize Log Insight AD server 389 TCP, UDP Active Directory

appliance

VMware, Inc. 106

Administering vRealize Log Insight

Source Destination Port Protocol Service Description

vRealize Log Insight AD server 636 TCP Active Directory over

appliance SSL

vRealize Log Insight AD server 3268 TCP Active Directory Global

appliance Catalog

vRealize Log Insight AD server 3269 TCP Active Directory Global

appliance Catalog SSL

vRealize Log Insight AD server 88 TCP, UDP Kerberos

appliance

vRealize Log Insight vCenter Server 443 TCP vCenter Server Web
appliance Service

vRealize Log Insight vRealize Operations 443 TCP vRealize Operations

appliance Manager appliance Web service

vRealize Log Insight Third-party log 514 TCP, UDP syslog data
appliance manager

vRealize Log Insight Third-party log 9000 CFAPI Outbound Log Insight
appliance manager Ingestion API (CFAPI)
traffic configured as a
Forwarder destination

vRealize Log Insight Third-party log 9543 CFAPI Outbound Log Insight
appliance manager Ingestion API (CFAPI)
traffic configured as a
Forwarder destination
with encryption (SSL/
TLS)

Ports That Can Be Blocked

The following ports are open but not used by vRealize Log Insight. These ports can be safely blocked by
a firewall.

Destination Port Protocol Service Description

vRealize Log Insight appliance 111 TCP, UDP RPCbind service that converts
RPC program numbers into
universal addresses.

vRealize Log Insight appliance 9007 TCP Tomcat services

Tomcat service

vRealize Log Insight Configuration Files

Some configuration files contain settings that affect vRealize Log Insight security.

Note All security-related resources are accessible by the root account. Protecting this account is critical
to the security of vRealize Log Insight.

VMware, Inc. 107

Administering vRealize Log Insight

Table 12-1. Log Insight Configuration Files

File Description

/usr/lib/loginsight/application/etc/loginsight- The default system configuration for vRealize Log Insight.

[Link]

/storage/core/loginsight/config/loginsight- The modified (from the default) system configuration forvRealize

[Link]#number Log Insight.

/usr/lib/loginsight/application/etc/[Link] The configuration for active directory integration.

/usr/lib/loginsight/application/etc/3rd_config/ The system configuration for Apache Tomcat server.

[Link]

/storage/var/loginsight/apache-tomcat/conf/tomcat- The system configuration for Apache Tomcat server.

[Link]

/usr/lib/loginsight/application/3rd_party/apache- The system configuration for Apache Tomcat server.

tomcat-*/conf/[Link]

/usr/lib/loginsight/application/3rd_party/apache- User information for Apache Tomcat server.

tomcat-*/conf/[Link]

vRealize Log Insight Public Key, Certificate, and Keystore

The public key, the certificate, and the keystore of vRealize Log Insight are located on the vRealize Log
Insight virtual appliance.

Note All security-related resources are accessible by the root account. Protecting this account is critical
to the security of vRealize Log Insight.

n /usr/lib/loginsight/application/etc/[Link]

n /usr/lib/loginsight/application/etc/[Link]

n /usr/lib/loginsight/application/etc/3rd_config/keystore

n /usr/lib/loginsight/application/etc/truststore

n /usr/lib/loginsight/application/3rd_party/apache-tomcat-*/conf/keystore

vRealize Log Insight License and EULA File

The end-user license agreement (EULA) and license file are located on the vRealize Log Insight virtual
appliance.

Note All security-related resources are accessible by the root account. Protecting this account is critical
to the security of vRealize Log Insight.

File Location

License /usr/lib/loginsight/application/etc/license/loginsight_dev.dlf

License /usr/lib/loginsight/application/etc/license/loginsight_cpu.dlf

VMware, Inc. 108

Administering vRealize Log Insight

File Location

License /usr/lib/loginsight/application/etc/license/loginsight_osi.dlf

License Key file /usr/lib/loginsight/application/etc/license/loginsight_license.bak

End-user license agreement /usr/lib/loginsight/application/etc/license/release/[Link]

vRealize Log Insight Log Files

The files that contain system messages are located on the vRealize Log Insight virtual appliance.

The following table lists each file and its purpose.

If you need information on log rotation or log archiving for these files, see Log Rotation Schemes
Supported by vRealize Log Insight Agents in Working with vRealize Log Insight Agents and Enable or
Disable Data Archiving in vRealize Log Insight in Administering vRealize Log Insight.

File Description

/storage/var/loginsight/[Link] Used to track information about user-defined alerts that have been
triggered.

/storage/var/loginsight/apache-tomcat/logs/ Used to track events from Apache Tomcat server.

*.log

/storage/var/loginsight/[Link] Used to track cluster configuration storage and replication in Apache

Cassandra.

/storage/var/loginsight/plugins/vsphere/li- Used to trace events related to integration with vSphere Web Client.
[Link]

/storage/var/loginsight/ Used for the standard output of vRealize Log Insight daemon.
loginsight_daemon_stdout.log

/storage/var/loginsight/[Link] Used to track information about trace data collection sent to VMware
(if enabled).

/storage/var/loginsight/[Link] Used to track database start or stop events.

/storage/var/loginsight/[Link] Used to track all run time information related to vRealize Log Insight.

/var/log/firstboot/[Link] Used to track the events that occur at first boot and configuration of
the vRealize Log Insight virtual appliance.

/storage/var/loginsight/[Link] Used to track information about system notifications that vRealize Log
Insight sends. Each alert is listed as a JSON entry.

/storage/var/loginsight/systemalert_worker.log Used to track information about system notifications that a vRealize

Log Insight worker node sends. Each alert is listed as a JSON entry.

/storage/var/loginsight/[Link] Used to track events related to the vRealize Log Insight user
interface.

/storage/var/loginsight/ui_runtime.log Used to track runtime events related to the vRealize Log Insight user
interface.

/storage/var/loginsight/[Link] Used to track events that occur during vRealize Log Insight upgrade.

/storage/var/loginsight/[Link] Used to track all queries.

VMware, Inc. 109

Administering vRealize Log Insight

File Description

/storage/var/loginsight/vcenter_operations.log Used to track events related to the vRealize Operations Manager

integration

/storage/var/loginsight/watchdog_log* Used to track the run time events of the watch dog process, which is
responsible for restarting vRealize Log Insight if it is shutdown for
some reason.

/storage/var/loginsight/api_audit.log Used to track the API calls to Log Insight.

/storage/var/loginsight/pattern_matcher.log Used to track the pattern matching times and timeouts for field
extraction.

Log Messages Related to Security

The ui_runtime.log file contains user audit log messages in the following format.

n [2019-05-10 11:28:29.709+0000] ["https-jsse-nio-443-exec-9"/[Link] DEBUG]

[[Link]] [User login success:
vIDM: SAM=myusername, Domain=[Link], UPN=myusername@[Link]]

n [2019-05-10 11:28:45.812+0000] ["https-jsse-nio-443-exec-3"/[Link] INFO]

[[Link]] [User logged out: vIDM:
SAM=myusername, Domain=[Link], UPN=myusername@[Link]]

n [2019-05-10 11:28:29.709+0000] ["https-jsse-nio-443-exec-9"/[Link] DEBUG]

[[Link]] [User login success:
Active Directory User: SAM=myusername,
Domain=[Link],UPN=myusername@[Link]]

n [2019-05-10 11:28:45.812+0000] ["https-jsse-nio-443-exec-3"/[Link] INFO]

[[Link]] [User logged out: Active
Directory User: SAM=myusername, Domain=[Link],UPN=myusername@[Link]]

n [2019-05-10 11:29:28.330+0000] ["https-jsse-nio-443-exec-6"/[Link] DEBUG]

[[Link]] [User login success:
Local User: Name=myusername]

n [2019-05-10 11:29:47.078+0000] ["https-jsse-nio-443-exec-10"/[Link] INFO]

[[Link]] [User logged out: Local
User: Name=myusername]

n [2019-05-10 11:29:23.559+0000] ["https-jsse-nio-443-exec-7"/[Link] WARN]

[[Link]] [User login failure: Bad
username/password attempt (username: incorrectUser)]

n [2019-05-10 11:45:37.795+0000] ["https-jsse-nio-443-exec-7"/[Link] INFO]

[[Link]] [Created new user:
Local User: Name=myusername]

VMware, Inc. 110

Administering vRealize Log Insight

n [2019-05-10 11:09:50.493+0000] ["https-jsse-nio-443-exec-6"/[Link] INFO]

[[Link]] [Created new user:
vIDM: SAM=myusername, Domain=[Link], UPN=myusername@[Link]]

n [2019-05-10 11:47:05.202+0000] ["https-jsse-nio-443-exec-10"/[Link] INFO]

[[Link]] [Created new group:
(directoryType= VIDM, domain=[Link], group=vidm_admin)]

n [2019-05-10 11:58:11.902+0000] ["https-jsse-nio-443-exec-4"/[Link] INFO]

[[Link]] [Removed groups:
[class [Link]<vidm/[Link]/
vidm_admin>]]

Note
n Some logs are available in debug level. For information about enabling the debug level for each node,
see Enable Debug Level for User Audit Log Messages.

n Each node in a vRealize Log Insight cluster has its own ui_runtime.log file. You can examine the
log files of the nodes to monitor the cluster.

Enable Debug Level for User Audit Log Messages

You can enable the debug level for user audit log messages to include the log messages in the
ui_runtime.log file.

Prerequisites

Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

Procedure

1 Navigate to the location /usr/lib/loginsight/application/etc/ and open the configuration file

[Link] in any text editor.

2 For the appender with the name UI_RUNTIME_FILE, update the Threshold parameter value to DEBUG:

<appenders>
<appender name="UI_RUNTIME_FILE"
class="[Link]">
<param name="Threshold" value="DEBUG"/>
</appender>
</appenders>

3 Add a new logger for LoginActionBean with the DEBUG login level:

<loggers>
<logger name="[Link]" level="DEBUG"
appender="UI_RUNTIME_FILE" additivity="false"/>
</loggers>

4 Save and close the [Link] file.

VMware, Inc. 111

Administering vRealize Log Insight

5 Run the service loginsight restart command to apply your changes.

vRealize Log Insight User Accounts

You must set up a system and a root account to administer vRealize Log Insight.

vRealize Log Insight Root User

vRealize Log Insight currently uses the root user account as the service user. No other user is created.

Unless you set the root password property during deployment, the default root password is blank. You
must change the root password when you log in to the vRealize Log Insight console for the first time.

SSH is disabled until the default root password is set.

The root password must meet the following requirements.

n Must be at least eight characters long

n Must contain at least one uppercase letter, one lowercase letter, one digit, and one special character

n Must not repeat the same character four times

vRealize Log Insight Admin User

When you start the vRealize Log Insight virtual appliance for the first time, vRealize Log Insight creates
the admin user account for its Web user interface.

The default password for admin is blank. You must change the admin password in the Web user interface
during the initial configuration of vRealize Log Insight.

Active Directory Support

vRealize Log Insight supports integration with Active Directory. When configured, vRealize Log Insight
can authenticate or authorize a user against Active Directory.

See Enable User Authentication Through Active Directory.

Privileges Assigned to Default Users

The vRealize Log Insight service user has root privileges.

The Web user interface admin user has the administrator privileges only to the vRealize Log Insight web
user interface.

vRealize Log Insight Firewall Recommendations

To protect sensitive information gathered by vRealize Log Insight, place the server or servers on a
management network segment protected by a firewall from the rest of your internal network.

VMware, Inc. 112

Administering vRealize Log Insight

Required Ports
The following ports need to be open to network traffic from sources that send data to vRealize Log
Insight.

Port Protocol

514/UDP, 514/TCP Syslog

1514/TCP, 6514/TCP Syslog-TLS (SSL)

9000/TCP vRealize Log Insight Ingestion API

9543/TCP vRealize Log Insight Ingestion API - TLS (SSL)

The following ports need to be open to network traffic that needs to use the vRealize Log Insight UI.

Port Protocol

80/TCP HTTP

443/TCP HTTPS

The following set of ports should only be open on a vRealize Log Insight master node for network access
from worker nodes for maximum security.

Port Protocol

16520:16580/TCP Thrift RPC

59778/TCP log4j server

12543/TCP database server

Security Updates and Patches

The vRealize Log Insight virtual appliance uses SUSE Linux Enterprise Server 11 (x86_64), version 11,
patch level 4 as the guest operating system.

VMware releases patches to address security issues in maintenance releases. You can download these
patches from the vRealize Log Insight download page.

Before you apply an upgrade or patch to the guest operating system, consider the dependencies. See
Chapter 6 Ports and External Interfaces .

VMware, Inc. 113

 13
Backup, Restore, and Disaster
Recovery

To guard against expensive data center downtime, follow these best practices for performing vRealize
Log Insight backup, restoration, and disaster recovery operations.

This chapter includes the following topics:

n Backup, Restore, and Disaster Recovery Overview

n Using Static IP Addresses and FQDN

n Planning and Preparation

n Backup Nodes and Clusters

n Backup Linux or Windows Agents

n Restore Nodes and Clusters

n Changing Configurations After Restoration

n Verify Restorations

n Disaster Recovery

Backup, Restore, and Disaster Recovery Overview

VMware delivers a comprehensive, integrated portfolio of Business Continuity and Disaster Recovery
(BCDR) solutions that provide high availability, data protection, and disaster recovery.

Use the backup, restore, and disaster recovery information in this document for vRealize Log Insight
components, including the master node, worker node and forwarder.

n For information about master and worker cluster members, including configuration, log data and
customization, see Backup Nodes and Clusters.

n For information about Linux or Windows agent local configuration, see Backup Linux or Windows
Agents.

The information in this document does not apply to the following tools and products. You must to obtain
information about these tools and products from multiple resources.

n Third-party tools that are specifically used for backup, restore, and disaster recovery. For more
information, see the vendor documentation.

VMware, Inc. 114

Administering vRealize Log Insight

n vSphere Data Protection, Site Recovery Manager, and Symantec NetBackup. For additional
information on VMware BCDR solutions, see [Link]
[Link].

n Backup, restore, and disaster recovery capability for products that integrate with vRealize Log Insight.

n vRealize Operations Manager

n vSphere Web Client server

n ESXi hosts

Using Static IP Addresses and FQDN

You can use static IP addresses and FQDN to avoid risk during backup, restoration, and disaster
recovery operations.

Static IP Addresses for vRealize Log Insight Cluster Nodes and

Load Balancer
When you use static IP addresses for all nodes in a vRealize Log Insight cluster, you eliminate the need
to update the IP addresses of the cluster nodes when the IP addresses change.

vRealize Log Insight includes all node IP addresses in each cluster node configuration file as described in
Knowledge Base article 2123058

All products that integrate with vRealize Log Insight (ESXi, vSphere, vRealize Operations) use the cluster
master node's fully qualified domain name (FQDN) or IP address as the syslog target. Those products
might use the FQDN or IP address of the load balancer, if configured, as the syslog target. Static IP
addresses reduce the risk of constantly updating the syslog target IP address in multiple locations.

Provide static IP addresses and optional virtual IP addresses for the load balancer. When configuring an
integrated load balancer, provide the optional FQDN for the virtual IP address. The FQDN is used when
an IP address is not reachable for any reason.

FQDN for vRealize Log Insight Cluster Nodes and Worker Node
When you use an FQDN for all nodes in the vRealize Log Insight cluster, you can save time on post-
restoration and recovery configuration changes, assuming that the same FQDN can be resolved on the
recovery site.

For the master node (load balancer when used), a fully resolvable FQDN is required. Otherwise, the ESXi
hosts fail to feed the syslog messages to vRealize Log Insight or to any remote target.

For system notifications, vRealize Log Insight uses FQDN host names, if available, instead of IP
addresses.

You can reasonably assume that only underlying IP addresses change post-backup and restoration or
disaster recovery operations. Using FQDN eliminates the need to change the syslog target address
(master node FQDN or internal load balancer FQDN) on all the external devices that feed logs to the
vRealize Log Insight cluster.

VMware, Inc. 115

Administering vRealize Log Insight

Verify that join requests from a vRealize Log Insight worker node use the FQDN of the vRealize Log
Insight master node.

The master node host value in the configuration file on each of the nodes is based on the value used by
the first worker node sending a join request. Using the FQDN of the master node for the join request
prevents making any manual changes to the master node host value post-disaster recovery. Otherwise,
the worker nodes cannot rejoin the master node until the master node host name is updated in the
configuration files on all restored cluster nodes.

Planning and Preparation

Before implementing a backup, restoration, or disaster recovery procedure, review the planning and
preparation information in this topic.

The following recommendations should be included in a backup, restoration, and disaster recovery plan.

Test Backup Operations

Perform a test run of the backup, restoration, and disaster recovery operations in a test or staging
environment before performing these operations on a live production setup.

Perform a full backup of the entire vRealize Log Insight cluster. Do not rely on automatic procedures to
back up individual files and configurations.

Verify Fixes
Verify that fixes are implemented and warnings and errors are addressed before performing backup,
restoration, and disaster recovery operations. Backup, restoration, and disaster recovery tools usually
provide visual validations and steps to ensure that backup, restoration, and disaster recovery
configurations are successfully created.

Scheduling Backups
Depending on the cluster configuration, the first backup operation is usually a full backup. You should
allow for an extended period of time for the first backup to complete. Successive backups, which can be
incremental or full backups, finish relatively faster compared to the first backup operation.

Additional Documentation and Tools

Verify that you are following the documentation for allocating resources for the vRealize Log Insight
backup, restoration, and disaster recovery tools.

Verify that you are following the tool-specific best practices and recommendations for third-party backup,
restoration, and disaster recovery tools.

For virtual machines deployed using VMware products, use additional tools that can provide special
features and configurations to support backup, restoration, and disaster recovery.

VMware, Inc. 116

Administering vRealize Log Insight

Forwarders and Clusters

For forwarders, apply the backup, restoration, and disaster recovery steps for the main vRealize Log
Insight cluster. See Restore Nodes and Clusters.

Based on the customer requirements, you might have a single or multiple vRealize Log Insight
forwarders. In addition, the forwarders can be installed as a standalone node or as a cluster. For the
purpose of backup, restoration, and disaster recovery operations, vRealize Log Insight forwarders are
identical to the primary vRealize Log Insight cluster nodes and handled the same way.

Backup Nodes and Clusters

It is a best practice to set up scheduled backups or replication for vRealize Log Insight nodes and
clusters.

Prerequisites

n Verify that no configuration problems exist on source and target sites before performing the backup or
replication operations.

n Verify that cluster resource allocation is not at capacity.

In configurations with reasonable ingestion and query loads, the memory and swap usage can reach
almost 100% capacity during backup and replication operations. Because memory is near capacity in
a live environment, part of the memory spike is due to the vRealize Log Insight cluster usage. Also,
the scheduled backup and replication operations can contribute significantly to the memory spike.

In some cases, worker nodes are disconnected momentarily for 1 to 3 minutes before rejoining
master nodes, possibly because of high memory usage.

n Reduce the memory throttling on vRealize Log Insight nodes by doing one or both of the following:

n Allocate additional memory over the vRealize Log Insight recommended configurations.

n Schedule the recurring backups during off-peak hours.

Procedure

1 Enable regular backup or replication of vRealize Log Insight forwarders by using the same
procedures that you use for the vRealize Log Insight server.

2 Verify that the backup frequency and backup types are appropriately selected based on the available
resources and customer-specific requirements.

3 If the resources are not a problem and if it is supported by the tool, enable concurrent cluster node
backups to speed up the backup process.

4 Back up all the nodes at the same time.

VMware, Inc. 117

Administering vRealize Log Insight

What to do next

Monitoring—As the backup is in progress, check any environment or performance problems in the
vRealize Log Insight setup. Most backup, restore, and disaster recovery tools provide monitoring
capabilities.

During the backup process, check all the relevant logs on the production system because the user
interface might not display all problems.

Backup Linux or Windows Agents

You backup agents by backing up installation and configuration information on the server side. A separate
backup of the agent node is not required.

Agents are typically installed on Linux or Windows systems that also used for some other application or
service and might be included in existing backup procedures. A full file-level or block-level backup of the
machine that includes the entire agent installation and its configuration is sufficient for recovery. Agents
support both local and server-provided configuration.

If the agent is configured entirely from the vRealize Log Insight server, without any local change to the
[Link] configuration file, you can avoid creating a backup of the agent installation at all. Instead,
perform a fresh installation of the agent and retrieve the server backup.

If the agent has a custom local configuration, backup the [Link] file and restore it along with a
fresh installation of the agent. If you use the agent nodes for more than installing the agent software and if
these nodes need a full backup, follow the same backup procedure as for any other virtual machine.

If the agent configuration is done on the client side (on the agents) and if the agent nodes are used only
for vRealize Log Insight agent software installation, making a backup of the agent configuration file is
sufficient.

Prerequisites

Verify that the agent configuration is on the vRealize Log Insight server side.

Procedure

1 Backup the [Link] file.

2 Replace the file on the recovered agent or Linux or Windows machine with the backup file.

Restore Nodes and Clusters

Nodes must be restored in a specific order and some restoration scenarios may require manual
configuration changes.

Depending on the tool used for restoring, you can restore the virtual machines to the same host, a
different host on the same data center, or a different host on a target remote data center. See Changing
Configurations After Restoration

VMware, Inc. 118

Administering vRealize Log Insight

Prerequisites

n Verify that the restored nodes are in the powered off state.

n Verify that the cluster instances are powered off before restoring the cluster to a new site.

n Verify that no split-brain behavior occurs when the same IP addresses and FQDNs are used on the
recovery site.

n Verify that no one is accidentally using a partially working cluster on the primary site.

Procedure

1 Restore the master node first before restoring worker nodes.

2 Restore worker nodes in any order.

3 (Optional) Restore the forwarders if configured.

Be sure the vRealize Log Insight server (the master node and all the worker nodes in a cluster setup)
are restored before restoring the forwarders.

4 Restore any recovered agents.

What to do next

n When restoring a vRealize Log Insight cluster, if the same IP addresses are used, verify that all
restored node IP addresses and FQDNs are associated with their original counterparts.

For example, the following scenario would fail. In a three-node cluster with nodes A, B, and C, node A
is restored with IP address B, node B is restored with IP address C, and node C is restored
with IP address A.

n If the same IP addresses are used for only a subset of restored nodes, verify that for these
nodes, all restored images are associated with their original IP addresses.

n Most backup restoration and disaster recovery tools provide a monitoring view for watching the
progress of the restoration operations for failures or warnings. Take appropriate actions on any
identified problems.

n If manual configuration changes are required before the site can be fully restored, follow
the guidelines in the Changing Configurations After Restoration.

n When a successful restoration is finished, perform a spot check of the cluster that was restored.

Changing Configurations After Restoration

The recovery target and IP customizations applied during the backup configuration determine which
manual configuration changes are required. You must apply configuration changes to one or more
vRealize Log Insight nodes before the restored site can become fully functional.

VMware, Inc. 119

Administering vRealize Log Insight

Restore to the Same Host

Recovering a vRealize Log Insight cluster to the same host is straightforward and can be performed by
any tool.

Prerequisites

Review important information about Planning and Preparation.

Procedure

1 Power off the existing cluster before beginning the restoration operation. By default, the same IP
addresses and FQDNs are used for the restored cluster nodes.

2 (Optional) Provide a new name for the cluster.

During the restoration process, the original copy of the cluster is overwritten with the restored version
unless a new name is provided to the virtual machine.

3 (Optional) If possible, verify that all network, IP, and FQDN settings that are used for the production
environment are preserved in the restored and recovered site.

What to do next

After a successful restoration and a sanity check, delete the old copy to conserve resources and to
prevent accidental split-brain situations if a user powers on the old copy.

Restore to a Different Host

When you perform a restoration to a different host, you must make configuration changes on the vRealize
Log Insight cluster.

Making changes to the configuration files directly from the appliance console is not officially supported in
vRealize Log Insight 3.0 and later releases. See Knowledge Base article 2123058 for information about
how to make these changes by using the Web UI interface.

These configuration changes are specific to vRealize Log Insight builds that can be used with any backup
recovery tool.

Recovering to a different host requires manual configuration changes on the vRealize Log Insight cluster.
You can assume that the restored vRealize Log Insight nodes have different IP addresses and FQDNs
than their source counterparts from which a backup was taken.

Prerequisites

Review important information about Planning and Preparation.

Procedure

1 List all new IP addresses and FQDNs that were assigned to each vRealize Log Insight node.

VMware, Inc. 120

Administering vRealize Log Insight

2 Make the following configuration changes on the master node by using the steps described in
Knowledge Base article 2123058.

a In the vRealize Log Insight config section, look for lines that resemble the following lines.

<distributed overwrite-children="true">
<daemon host="[Link]" port="16520" token="c4c4c6a7-f85c-4f28-
a48f-43aeea27cd0e">
<service-group name="standalone" />
</daemon>
<daemon host="[Link]" port="16520" token="a5c65b52-aff5-43ea-8a6d-38807ebc6167">
<service-group name="workernode" />
</daemon>
<daemon host="[Link]" port="16520" token="a2b57cb5-a6ac-48ee-8e10-17134e1e462e">
<service-group name="workernode" />
</daemon>
</distributed>

The code shows three nodes. The first node is the master node, which shows <service-group
name=standalone>, and the remaining two nodes are worker nodes, which show <service-
group name="workernode">

b For the master node, in the newly recovered environment, verify that the DNS entry that was
used in the pre-recovery environment can be reused.

n If the DNS entry can be reused, update only the DNS entry to point to the new IP address of
the master node.

n If the DNS entry cannot be reused, replace the master node entry with a new DNS name
(pointing to the new IP address).

n If the DNS name cannot be assigned, as a last option, update the configuration entry with the
new IP address.

c Update the worker node IP addresses as well to reflect the new IP addresses.

VMware, Inc. 121

Administering vRealize Log Insight

d In the same configuration file, verify that you have entries that represent NTP, SMTP, and
database and appenders sections.

<ntp>
<ntp-servers value="[Link], [Link]" />
</ntp>

<smtp>
<server value="[Link]" />
<default-sender value="[Link]@[Link]" />
</smtp>

<database>
<password value="xserttt" />
<host value="[Link]" />
<port value="12543" />
</database>

n If the configured NTP server values are no longer valid in the new environment, update these
values in the <ntp>...</ntp> section

n If the configured SMTP server values are no longer valid in the new environment, update
these values in the <smtp>...</smtp> section.

n Optionally, change the default-sender value in the SMTP section. The value can be any
value but as a good practice, represent the source from where the email is being sent.

n In the <database>..</database> section, change the host value to point to the master
node FQDN or IP address.

e In the same configuration file, update the vRealize Log Insight ILB configuration section.

<load-balancer>
<leadership-lease-renewal-secs value="5" />
<high-availability-enabled value="true" />
<high-availability-ip value="[Link]" />
<high-availability-fqdn value="[Link]" />
<layer4-enabled value="true" />
<ui-balancing-enabled value="true" />
</load-balancer>

f Under the <load-balancer>...</load-balancer> section, update the high-availability-

ip value if it is different from the current setting.

g Ensure that you also update the FQDN of the load balancer.

h Restart from the Web UI through the Cluster tab on the Administration page. For each node
listed, select its host name or IP address to open the details panel and click Restart Log Insight.

The configuration changes are automatically applied to all cluster nodes.

i Wait 2 minutes after the vRealize Log Insight service starts to allow enough time for the
Cassandra service to start before bringing other worker nodes online.

VMware, Inc. 122

Administering vRealize Log Insight

What to do next

Verify that the restored vRealize Log Insight nodes have been assigned different IP addresses and
FQDNs than their source counterparts from which a backup was taken.

Verify Restorations
You must verify that all restored vRealize Log Insight clusters are fully functional.

Prerequisites

Confirm that the backup and restoration process is complete before verifying node and cluster
configurations.

Procedure

1 Log in to vRealize Log Insight using the internal load balancer (ILB) IP address or the FQDN (if
configured).

2 Click the configuration drop-down menu icon and select Administration.

3 Verify the following:

a Verify that you can access all individual cluster nodes using the respective IP addresses or
FQDNs.

b Verify the status of cluster nodes from the cluster page and ensure that the ILB, if configured, is
also in an active state.

c Verify the vSphere integration. If required, reconfigure the integration. Reconfiguration is required
when the ILB and/or the master node IP address or FQDN is changed post-recovery.

d Verify the vRealize Operations Manager integration and reconfigure again if needed.

e Verify that all content packs and UI features are functioning properly.

f Verify that vRealize Log Insight forwarders and agents are functioning properly, if configured.

4 Verify that other key features of vRealize Log Insight are functioning as expected.

What to do next

Make any necessary adjustments to your backup and recovery plan to address any issues that may have
been identified during your backup, restoration, and verification operations.

Disaster Recovery
A well-documented and well-tested recovery plan is essential to quickly returning a cluster to a working
state.

The choice of replication type is critical when configuring a virtual machine for disaster recovery. Consider
the Recovery Point Objective (RPO), the Recovery Time Objective (RTO), and the cost and scalability
when deciding on a replication type.

VMware, Inc. 123

Administering vRealize Log Insight

In a disaster recovery scenario, sometimes you cannot restore to the same site if the primary site is fully
down. But based on the option you choose, some manual steps are required to fully restore and return
the vRealize Log Insight cluster to a running state.

Unless the vRealize Log Insight cluster is fully down and inaccessible, verify that the cluster instances are
powered off before restoring the cluster to a new site.

During an outage or disaster, recover the vRealize Log Insight cluster as soon as possible.

VMware, Inc. 124

 14
Troubleshooting vRealize Log
Insight

You can solve common problems related to vRealize Log Insight administration before calling VMware
Support Services.

This chapter includes the following topics:

n Cannot Log In to vRealize Log Insight on Internet Explorer

n vRealize Log Insight Runs Out of Disk Space

n Import of Archived Data Might Fail

n Use the Virtual Appliance Console to Create a Support Bundle of vRealize Log Insight

n Reset the Admin User Password

n Reset the Root User Password

n Alerts Could Not Be Delivered to vRealize Operations Manager

n Unable to Log In Using Active Directory Credentials

n SMTP does not work with STARTTLS option enabled

n Upgrade Fails Because the Signature of the .pak file Cannot Be Validated

n Upgrade Fails with an Internal Server Error

n Missing vmw_object_id Field in the First Log Message After Integration with VMware Products

Cannot Log In to vRealize Log Insight on Internet

Explorer
vRealize Log Insight authentication fails on Internet Explorer.

Problem

The vRealize Log Insight web client requires LocalStorage or DOM storage support, but your filesystem
integrity level prohibits Internet Explorer from using LocalStorage. The console and debugger display the
error SCRIPT5: Access is Denied.

VMware, Inc. 125

Administering vRealize Log Insight

Cause

vRealize Log Insight cannot access LocalStorage or DOM Storage support. Internet Explorer keeps this
storage data in the folder set with the CachePath parameter, nominally at %USERPROFILE%\AppData
\LocalLow\Microsoft\Internet Explorer\DOMstore. If this folder has an integrity level other than
low, Internet Explorer is unable to use LocalStorage.

Solution

You can use the following command to set the integrity level of a user account.

icacls %userprofile%\Appdata\LocalLow /t /setintegritylevel (OI)(CI)L

vRealize Log Insight Runs Out of Disk Space

A vRealize Log Insight master or worker node might run out of disk space if you are using a small virtual
disk, and archiving is not enabled.

Problem

vRealize Log Insight runs out of disk space if the rate of incoming logs exceeds 3 percent of the storage
space per minute.

Cause

In normal situations, vRealize Log Insight never runs out of disk because every minute it checks if the free
space is less than 3 percent. If the free space on the vRealize Log Insight virtual appliance drops below 3
percent, old data buckets are retired.

However, if the disk is small and log ingestion rate is so high that the free space (3 percent) is filled out
within 1 minute, vRealize Log Insight runs out of disk.

If archiving is enabled, vRealize Log Insight archives the bucket before retiring it. If the free space is filled
before the old bucket is archived and retired, vRealize Log Insight runs out of disk.

Solution

u Increase the storage capacity of the vRealize Log Insight virtual appliance. See Increase the Storage
Capacity of the vRealize Log Insight Virtual Appliance.

Import of Archived Data Might Fail

The import of archived data might fail if the vRealize Log Insight vRealize Log Insight virtual appliance
runs out of disk space.

Problem

The vRealize Log Insight repository import utility does not check for available disk space on the vRealize
Log Insight virtual appliance. Therefore, the import of archived logs might fail if the virtual appliance runs
out of disk space.

VMware, Inc. 126

Administering vRealize Log Insight

Solution

Increase the storage capacity of the vRealize Log Insight virtual appliance and start the import again.
Increase the Storage Capacity of the vRealize Log Insight Virtual Appliance. Note, though, that
information that was successfully imported before failure will be duplicated.

Use the Virtual Appliance Console to Create a Support

Bundle of vRealize Log Insight
If you cannot access the vRealize Log Insight Web user interface, you can download the support bundle
by using the virtual appliance console or after establishing an SSH connection to the vRealize Log Insight
virtual appliance.

Prerequisites

n Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

n If you plan to connect to the vRealize Log Insight virtual appliance by using SSH, verify that TCP port
22 is open.

Procedure

1 Establish an SSH connection to the vRealize Log Insight vApp and log in as the root user.

2 To generate the support bundle, run loginsight-support.

To generate a support bundle and include only files that have changed within a certain time period,
execute the loginsight-support command with the --days constraint. For example, --days=1 will
only include files that have changed within 1 day.

Results

The support information is collected and saved in a *.[Link] file that has the following naming
convention: loginsight-support-YYYY-MM-DD_HHMMSS.[Link], where xxxxx is the process ID
under which the loginsight-support process ran.

What to do next

Forward the support bundle to VMware Support Services as requested.

Reset the Admin User Password

If an Admin user forgets the password to the Web user interface, the account becomes unreachable.

Prerequisites

n Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

n To enable SSH connections, verify that TCP port 22 is open.

VMware, Inc. 127

Administering vRealize Log Insight

Problem

If vRealize Log Insight has only one Admin user and the Admin user forgets the password, the application
cannot be administered. If an Admin user is the only user of vRealize Log Insight, the whole Web user
interface becomes inaccessible.

Cause

If a user does not remember their current password, vRealize Log Insight does not provide a user
interface for Admin users to reset their own passwords.

Note Admin users who can log in can reset the password of other Admin users. Reset the Admin user
password only when all Admin user accounts' passwords are unknown.

Solution

1 Establish an SSH connection to the vRealize Log Insight virtual appliance and log in as the root user.

2 To get the Cassandra credentials for the script that resets the Admin user password, run the following
command and note the user and password values:

root@localhost [ ~ ]# /usr/lib/loginsight/application/lib/apache-cassandra-3*/bin/credentials-
look-up

The user and password values are generated in the following format:

<cassandra-user value="lisuper" />

<cassandra-password value="I33KnuHyPbsPZlYIx2MsEso4RotfgAXx" />

3 Run the script that resets the Admin user password with the Cassandra user and password values as
arguments, and press Enter. The following example uses the Cassandra credentials generated in the
previous step:

[Link] lisuper I33KnuHyPbsPZlYIx2MsEso4RotfgAXx

The script resets the Admin user password, generates a new password, and displays it on the screen.

What to do next

Log in to the vRealize Log Insight Web user interface with the new password and change the Admin user
password.

Reset the Root User Password

If you forget the password of the root user, you can no longer establish SSH connections or use the
console of the vRealize Log Insight virtual appliance.

VMware, Inc. 128

Administering vRealize Log Insight

You may not be able to log in as root for a variety of reasons including:

n You have not changed the default password. By default, vRealize Log Insight sets a blank password
for the root user and disables SSH access. Once the password is set, SSH access for the root user is
enabled.

n You set an SSH key during the deployment of the vRealize Log Insight virtual appliance. If an SSH
key is specified through OVF, then password authentication is disabled. Either log in with the set SSH
key or see the solution steps below.

n You entered the password incorrectly multiple times and you are now temporarily locked out. In this
case, entering the correct password will not get you in until the lock out period has elapsed. You can
either wait or restart the virtual appliance.

Problem

If you cannot establish SSH connections or use the console of the vRealize Log Insight virtual appliance,
you cannot accomplish some of the administration tasks, nor can you reset the password of the admin
user.

Solution

1 In the vSphere Client, perform a guest shutdown of the vRealize Log Insight virtual appliance.

2 After the virtual machine is powered down, select Edit Settings.

3 Select the Options tab.

4 Under vApp Options > Advanced, select Properties.

5 Find and edit the [Link] key.

If you do not see a [Link] key then add a new one.

If you are using SSH keys instead of password authentication, then edit or add the [Link] key.

6 Enter a password.

You can add an SSH key here instead if you are not using password authentication.

7 Power on the virtual appliance.

What to do next

After vRealize Log Insight boots, validate that you can log in as the root user.

Alerts Could Not Be Delivered to vRealize Operations

Manager
vRealize Log Insight notifies you if an alert event cannot be sent to vRealize Operations Manager.
vRealize Log Insight retries sending the alert every minute until the problem is resolved.

VMware, Inc. 129

Administering vRealize Log Insight

Problem

A red sign with an exclamation mark appears in the vRealize Log Insight toolbar when an alert could not
be delivered to vRealize Operations Manager.

Cause

Connectivity problems prevent vRealize Operations Manager vRealize Log Insight from sending alert
notifications to vRealize Operations Manager.

Solution

u Click on the red icon to open the list of error messages, and scroll down to view the latest message.

The red sign disappears from the toolbar when you open the list of error messages, or if the problem
is resolved.

u To fix the connectivity problem with vRealize Operations Manager, try the following.

n Verify that the vRealize Operations Manager vApp is not shut down.

n Verify that the you can connect to vRealize Operations Manager via the Test Connection button
in the vRealize Operations Manager section of the Administration page of the vRealize Log
Insight Web user interface.

n Verify that you have the correct credentials by logging directly into vRealize Operations Manager.

n Check vRealize Log Insight and vRealize Operations Manager logs for messages related to
connectivity problems.

n Verify that no alerts are filtered out in vRealize Operations Manager vSphere User Interface.

Unable to Log In Using Active Directory Credentials

You cannot log in to the vRealize Log Insight Web user interface when you use Active Directory
credentials.

Problem

You cannot log in to vRealize Log Insight by using your Active Directory domain user credentials, despite
that an administrator has added your Active Directory account to vRealize Log Insight.

Cause

The most common causes are expired passwords, incorrect credentials, connectivity problems, or lack of
synch between the vRealize Log Insight virtual appliance and Active Directory clocks.

Solution

n Verify that your credentials are valid, your password has not expired, and your Active Directory
account is not locked.

VMware, Inc. 130

Administering vRealize Log Insight

n If you have not specified a domain to use with Active Directory authentication, verify that you have an
account on the default domain stored in the latest vRealize Log Insight configuration at /storage/
core/loginsight/config/[Link]#[number] where [number] is the largest.

n Find the latest configuration file: /storage/core/loginsight/config/loginsight-

[Link]#[number] where [number] is the largest.

n Verify vRealize Log Insight has connectivity to the Active Directory server.

n Go to the Authentication section of the Administration page of the vRealize Log Insight Web
user interface, fill in your user credentials, and click the Test Connection button.

n Check the vRealize Log Insight /storage/var/loginsight/[Link] for messages related

to DNS problems.

n Verify that the vRealize Log Insight and Active Directory clocks are in synch.

n Check the vRealize Log Insight /storage/var/loginsight/[Link] for messages related

to clock skew.

n Use an NTP server to synchronize the vRealize Log Insight and Active Directory clocks.

SMTP does not work with STARTTLS option enabled

When you configure the SMTP server with the STARTTLS option enabled, test emails fail. Add your SSL
certificate for the SMTP server to the Java truststore to resolve the problem.

Prerequisites

n Verify that you have the root user credentials to log in to the vRealize Log Insight virtual appliance.

n If you plan to connect to the vRealize Log Insight virtual appliance by using SSH, verify that TCP port
22 is open.

Procedure

1 Establish an SSH connection to the vRealize Log Insight vApp and log in as the root user.

2 Copy the SSL certificate for the SMTP server to the vRealize Log Insight vApp.

3 Run the following command.

`/usr/java/latest/bin/keytool -import -alias certificate_name -file path_to_certificate -

keystore /usr/java/latest/lib/security/cacerts`

Note The outer quotes are inserted by using the back quote symbol that is on the same key as tilde
on your keyboard. Do not use single quotes.

4 Enter the default the password changeit.

5 Run the service loginsight restart command.

VMware, Inc. 131

Administering vRealize Log Insight

What to do next

Navigate to Administration > Smtp and use Send Test Email to test your settings. See Configure the
SMTP Server for vRealize Log Insight

Upgrade Fails Because the Signature of the .pak file

Cannot Be Validated
vRealize Log Insight upgrade fails because of a corrupted .pak file, expired license or insufficient disk
space.

Problem

Upgrading vRealize Log Insight fails and you see an error message Upgrade Failed. Failed to
upgrade: Signature of the PAK file cannot be validated.

Cause

The error might occur for the following reasons:

n The uploaded file is not a .pak file.

n The uploaded .pak file is not complete.

n The license of vRealize Log Insight has expired.

n The vRealize Log Insight virtual appliance root file system does not have enough disk space.

Solution

u Verify that you are uploading a .pak file.

u Verify the md5sum of the .pak file against the VMware download site.

u Verify that at least one valid license is configured on vRealize Log Insight.

u Log in to the vRealize Log Insight virtual appliance and run df -h to check the available disk space.

Note Do not put files on the vRealize Log Insight virtual appliance root file system.

Upgrade Fails with an Internal Server Error

vRealize Log Insight upgrade fails with an Internal Server Error because of a connection problem.

Problem

Upgrading vRealize Log Insight fails and you see an error message Upgrade Failed. Internal
Server Error.

Cause

A connection problem occurred between the client and the server. For example, when you attempt to
upgrade from a client that is on a WAN.

VMware, Inc. 132

Administering vRealize Log Insight

Solution

u Upgrade LI from a client on the same LAN as the server.

Missing vmw_object_id Field in the First Log Message

After Integration with VMware Products
After integrating vRealize Log Insight with VMware products, the first log message does not contain the
vmw_object_id field.

Problem

The first log message that you receive after you integrate vRealize Log Insight with vCenter Server and
vRealize Operations Manager does not contain the associated vmw_object_id field. The missing field
can have an impact on the alert delivery mechanism when a vRealize Operations Manager object is
specified as an alert target.

Note Ensure that the vCenter Server is also integrated with vRealize Operations Manager.

Solution

Wait for two minutes. The next log message that you receive will contain the vmw_object_id field.

VMware, Inc. 133