Log insight – vCOPS Content Pack
Log insight’s vCOPS Content Pack was released together with vCops 5.8, this content pack lets you get the same great insight into your vCops environment as log insight provides for your vSphere environment. There are three tasks to setting up vCops content pack for vCenter Log insight.
- Downloading and installing the content pack.
- Setting up vCops to syslog to Log insight.
- Connecting Log insight to vCops, so that Log insight can send alerts to vCops.
Downloading and installing vCops content pack for Log insight
If you have not already downloaded the content pack, lets start by doing that, it can be found on the VMware Solutions Exchange, just follow the direct link to it – vCenter Log insight Content Pack for vCenter Operations Manager. While you are there you might also wanna check out was else is there at the Solutions Exchange – There are quite a few content packs already.
So the content pack is download and ready to install. First login to Log insight, in the right corner click on the “gear” icon and choose “Content Packs”.
In the lower left corner click on “Import Content Pack”. Browse to the vCops content pack and click “import”.
Setting up vCops to syslog to Log insight
So the content pack is imported, now its time to get vCops to send its logs to Log insight. First SSH to the UI VM, change directory to “/usr/lib/vmware-vcops/user/conf/install/” and execute the command “vcops_loginsight_admin.sh configure <IP address>” as seen below. That’s all!
Connecting Log insight to vCops, so that Log insight can send alerts to vCops
This is quite basic, the content pack is imported and logs are now being sent to Log insight, but you might also want to sent alerts the other way. This is what we gonna enable now. What is an alert ? An alert is a query where some conditions are true.
- It could be on match.
- more than x numbers of event over a given time period.
- it can be a when an event threshold is over a given number and a given number of events over a given time period.
How do we setup the integration – Go click on the “gear” icon and click on “Administration” and then “VMware Integration”. Fill in the hostname, username and password and check the enabled, check box and finally click on “Test”.
If you wanna be able to link from vCops directly back to Log insight, you should enable “Launch in Context”, this is done by clicking on the “Enable Launch in Context…” and then click on “Register”. When done remember to click on “Save” and lastly click on “Restart Log Insight”.
Note that Esxi 5.x may need the syslog service reloaded on the host, in order for it to continue sending logs to the syslog. This can be done with a powercli script, see this blog post by Alan Renouf.
