Deploying VMware vRealize Log Insight

In this post I will be deploying VMware vRealize Log Insight version 3.3 appliance in my home lab. Log Insight is part of the vRealize suite of VMware management products. It provides real time log monitoring of your vSphere environment and can even integrate with vRealize Operations Manager. Normally your vCenter/host logs are collected but you never get use out of them, now with Log Insight it gives you a visual way to see any issues that could be happening behind the scenes. Basically vRealize Log Insight gives you structure for your unstructured logs!

An important announcement with 3.3 release is all users with a supported vCenter Server 6.0 license are entitled to a 25-OSI pack of Log Insight! Log Insight will accept the license key of vCenter 6.0 Standard, Enterprise or Enterprise Plus. If you have vCenter Server 5.x a license key can be obtained from the Log Insight download page then select Read More. Check out VMware Blog – Log Insight for vCenter FAQ for additional information about this release.

Deploying Log Insight:

I will be using the thick client to deploy Log Insight but you could use the web client. When you download the appliance it will be a OVA file: Go to File -> Deploy OVF Template:

Browse to the location of the OVA file. Select it then click Next:

Click Next:

To proceed the EULA must be scrolled down to the bottom then click Accept then Next:

Enter a name for the Log Insight VM and a folder location. Click Next:

Select the size of your environment. Since this is my lab I selected Extra Small.

• Extra Small: Proof of Concept Build – Up to 20 ESXi hosts
  • 2 CPU
  • 4 GB Memory
  • 132 of Storage (100 GB for event storage)
• Small: Up to 200 ESXi hosts
  • 4 CPU
  • 8 GB Memory
  • 510 GB of Storage (490 GB for event storage)
• Medium: Up to 500 ESXi hosts
  • 8 CPU
  • 16 GB Memory
  • 510 GB of Storage (490 GB for event storage)
• Large: Up to 1,500 ESXi hosts
  • 16 CPU
  • 32 GB Memory
  • 510 GB of Storage (490 GB for event storage)

Once you made your select click Next:

Select a Host or Cluster then click Next:

Select a Resource Pool if applicable, click Next:

Select the storage for the deployment. Click Next:

For best performance VMware recommends using Thick Eager Zeroed. If this is in a lab you can use Thin. Click Next:

Select which port group you want the VM deployed on. Click Next:

Fill out the fields with the information for your environment. Highly recommend not using DHCP. Ensure you remember what you entered for the Root Password. Click Next:

Click Finish to start the VM deployment.

Once completed click Close and power the VM on:

It will take a good chunk of time for Log Insight to fully boot. Just be patient. Once the console screen looks like the below you are ready to proceed:

Configuring the Appliance:

Now the VM is fully booted we need to configure it. Open a web browser and enter the IP address or DNS name of your appliance.

It will come up with the welcome message below. Click Next:

Since this is my first Log Insight appliance, click on Start New Deployment:

First it wants to update the admin account. Enter a email address and new password. Click Save and Continue:

If you are running 5.x use the key found on the Log Insight Product Page.

If you are running 6 enter your vCenter Server License Key.

If you have a paid license enter that instead. Click Continue:

If you wish to receive email notifications enter a email address here. Click Save and Continue:

If you wish to change the NTP do so then click Save and Continue:

Enter your SMTP settings if you wish to send notification emails. Click Save and Continue:

Initial setup complete, click Finish:

Configure to Log vSphere:

Now the initial setup is complete let’s integrate Log Insight to ingest vSphere data. Click Configure vSphere Integration:

Enter your vCenter hostname and username/password you wish to connect with. I created a Service Account and made it a member of the Administrators Group in vCenter. Ensure the two check boxes are selected then click Save:

If you go to the Hosts page you should see your vCenter and Hosts appear in here. It will take roughly 5-10 minutes for them to appear.

Content Packs:

Log Insight has Content Packs which extend its capabilities. I am running VSAN and there is a VSAN Pack. In the top right corner click the Hamburger Menu -> Content Packs:

Welcome to the Log Insight Content Pack Marketplace! The VSAN pack is at the bottom, click it:

On the pop up window check the box and click Install:

Click Ok:

Under Installed Content Packs, VSAN will appear:

Back on Dashboards click the drop down menu. Here you can switch to the VSAN Dashboard:

Give Log Insight a few hours then check back. You will see your charts starting to populate with collected data!

Training Video:

David Davis has an amazing PluralSight course on vCenter Log Insight that I highly recommend. vCenter Log Insight is the version before vRealize Log Insight but the concept is basically the same. If you haven’t checked out PluralSight it’s an amazing service! Check it out:

https://www.pluralsight.com/courses/vmware-vcenter-log-insight