Configuration Guide - VMware Solution Exchange
®
VMware vRealize Operations
Manager Content Pack for
vRealize Log Insight
Version 1.0
CONFIGURATION GUIDE
Contents
Overview .......................................................................................................................................... 3 vRealize Operations Manager Content Pack Features ............................................................... 3 Content Pack Components .......................................................................................................... 3 Compatibility ................................................................................................................................ 4 Integration with vRealize Log Insight ............................................................................................... 4 Installing the vRealize Log Insight Agent ..................................................................................... 4 Configuring the vRealize Log Insight Agent ................................................................................ 4 liagent.ini Configuration Options.............................................................................................. 5 liagent.ini Sample Configuration .............................................................................................. 5 Importing a Content pack into vRealize Log Insight .................................................................. 10 Configuring vRealize Log Insight to Send Notification Events .................................................. 10 VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
Overview
The vRealize Operations Manager content pack for vRealize Log Insight provides a way to
analyze all logs redirected from a vRealize Operations Manager instance. The content pack
contains various dashboards, queries and alerts to provide better diagnostics and troubleshooting
capabilities to the vRealize Operations Manager administrator. The content pack provides the
following capabilities:
Proactive monitoring and alert notifications of the vRealize Operations Manager clusters.
Specific alerts focused on important events that indicate problems can be enabled to send alerts
in vRealize Operations Manager as well as send email messages to administrators.
Cluster-role specific breakdown of vRealize Operations Manager events. Dashboards are
grouped based on the cluster role of the vRealize Operations Manger nodes/slices, such as
Master, Data, Replica, and the Remote Collector to provide better manageability.
vRealize Operations Manager Content Pack Features
The content pack has the following features:
Provides log aggregation in vRealize Log Insight. Log files used by vRealize Operations
Manager can be configured to redirect to vRealize Log Insight using the vRealize Log
Insight agent configuration file.
Enables an administrator to monitor and troubleshoot issues using queries and
dashboards. After logs are available in vRealize Log Insight, log data is analyzed and
displayed according to the various queries and dashboards. Issues could be related to
connectivity, system performance, data-related errors and exceptions, or any other
abnormal behavior at the vRealize Operations Manager cluster level or at the node
(Master, Data, or Remote Collector) level.
Provides configurable alert notifications. Configure alerts to send notifications for
operations such as multiple unauthenticated access attempts on vRealize Operations
Manager. In this example, you could determine if either the credentials of the user have
been updated or expired, or someone attempted to compromise the vRealize Operations
Manager system.
Effective monitoring of health and issues. The content pack presents the logs in a more
meaningful way, allowing for focus on the probable causes of failures in vRealize
Operations Manager. This can help to improve the reaction time if events are related to
known problems.
Content Pack Components
The vRealize Operation Manager content pack comprises of the following components:
12 Dashboard Groups
81 Dashboard Widgets
18 Queries
8 Alerts
31 Extracted Fields
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
Compatibility
The vRealize Operations Manager content pack requires vRealize Log Insight version 2.5 and
vRealize Operations Manager version 6.0 and 6.0.1.
You can download the vRealize Operations Manager content pack from the VMware Solution
Exchange:
https://solutionexchange.vmware.com/store/loginsight?src=Product_Product_LogInsight_YES_U
S.
Integration with vRealize Log Insight
The vRealize Log Insight agent must be installed and configured to integrate with vRealize
Operations Manager. To configure Log Insight agents, complete the following tasks.
Installing the vRealize Log Insight Agent
Configuring the vRealize Log Insight Agent
Importing a Content pack into vRealize Log Insight
Configuring vRealize Log Insight to Send Notification Events to vRealize Operations Manager
Installing the vRealize Log Insight Agent
The vRealize Log Insight agent is included with the vRealize Operations Manager 6.0.1
installation. If using this version of vRealize Operations Manager, you do not have to install the
agent separately.
If you are using vRealize Operations Manager 6.0, download and install the vRealize Log Insight
agent from the following location:
https://<Log Insight Instance>/admin/agents#
To install or update the vRealize Log Insight Linux agent, see http://pubs.vmware.com/log-insight25/topic/com.vmware.log-insight.administration.doc/GUID-0F1114AB-0315-478C-B84B863ABA393809.html.
Configuring the vRealize Log Insight Agent
The vRealize Log Insight agent enables the integration and manages communication between
vRealize Operations Manager and vRealize Log Insight. The liagent.ini file contains
configuration properties that control how the vRealize Log Insight agent sends events to vRealize
Log Insight servers, sets the communication protocol and port, and configures flat file log
collection.
To identify the source and cluster role, tags need to be updated in the liagent.ini
configuration file. As administrator, configure the following tags for each node role and on each
node in the cluster. The applicable values for Cluster roles are the following.
Master Replica Data Remote Collector VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
liagent.ini Configuration Options
The following is a sample .ini file for the vRealize Log Insight Linux agent. Modify the
configuration file according to your environment. The liagent.ini file is available in the
following location.
/VAR/LIB/LOGINSIGHT-AGENT/
Note: For vRealize Log Insight Windows agents, update the directory of the logs in the
liagent.ini file. By default, the logs are available in the following location.
C:\data\vcops\log
liagent.ini Sample Configuration
The following sample is a configuration file for a vRealize Log Insight agent that is configured for
vRealize Operations Manger 6.0 and higher. The vRealize Operations Manger content pack for
vRealize Log Insight requires that all tags listed below are in the following order to function
properly. Please note the following configuration considerations.
vmw_vr_ops_appname: do not update this tag
vmw_vr_ops_logtype: do not update this tag
vmw_vr_ops_clustername: this tag can be updated
vmw_vr_ops_clusterrole: change the tag to either the Master, Replica, Data, or
Remote Collector
vmw_vr_ops_nodename: this tag can be updated
vmw_vr_ops_hostname: The IP or FQDN of the vRealize Operations Manager node
vmw_vr_ops_hostname: this tag must be updated
vmw_vr_ops_clustername: this tag must be updated
vmw_vr_ops_clusterrole: this tag can be updated
vmw_vr_ops_nodename: this tag can be updated
The following configuration applies to a single vRealize Operations Manager node. For every
vRealize Operations Manager node, copy the configuration and update the tags accordingly.
[filelog|ANALYTICS-analytics]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"ANALYTICS",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include = analytics*.log*
exclude_fields=hostname
[filelog|COLLECTOR-collector]
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"COLLECTOR",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include = collector.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|COLLECTOR-collector_wrapper]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"COLLECTOR",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include = collector-wrapper.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\.\d{3}
[filelog|COLLECTOR-collector_gc]
directory = /data/vcops/log
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"COLLECTOR",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
include = collector-gc*.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\w]\d{2}:\d{2}:\d{2}\.\d{3}
[filelog|WEB-web]
directory = /data/vcops/log
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"WEB",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
include = web*.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|GEMFIRE-gemfire]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"GEMFIRE",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
directory = /data/vcops/log
include = gemfire*.log*
exclude_fields=hostname
[filelog|VIEW_BRIDGE-view_bridge]
tags = {"vmw_vr_ops_appname":"vROps",
"vmw_vr_ops_logtype":"VIEW_BRIDGE",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include = view-bridge*.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|VCOPS_BRIDGE-vcops_bridge]
tags = {"vmw_vr_ops_appname":"vROps",
"vmw_vr_ops_logtype":"VCOPS_BRIDGE",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include = vcops-bridge*.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|SUITEAPI-api]
directory = /data/vcops/log
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"SUITEAPI",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
include = api.log*;http_api.log*;profiling_api.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|SUITEAPI-suite_api]
directory = /data/vcops/log/suite-api
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"SUITEAPI",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
include = *.log*
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
exclude_fields=hostname
event_marker=^\d{2}-\w{3}-\d{4}[\s]\d{2}:\d{2}:\d{2}\.\d{3}
[filelog|ADMIN_UI-admin_ui]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"ADMIN_UI",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log/casa
include = *.log*;*_log*
exclude_fields=hostname
[filelog|CALL_STACK-call_stack]
tags = {"vmw_vr_ops_appname":"vROps",
"vmw_vr_ops_logtype":"CALL_STACK", "vmw_vr_ops_clustername":"Cluster1",
"vmw_vr_ops_clusterrole":"Master", "vmw_vr_ops_nodename":"Node1",
"vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log/callstack
include = analytics*.txt;collector*.txt
exclude_fields=hostname
[filelog|TOMCAT_WEBAPP-tomcat_webapp]
tags = {"vmw_vr_ops_appname":"vROps",
"vmw_vr_ops_logtype":"TOMCAT_WEBAPP",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log/product-ui
include = *.log*;*_log*
exclude_fields=hostname
[filelog|OTHER-other1]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"OTHER",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include =
aim*.log*;calltracer*.log*;casa.audit*.log*;distributed*.log*;hafailove
r*.log;his*.log*;installer*.log*;locktrace*.log*;opsapi*.log*;queryservice-timer*.log*;queryprofile*.log*;vcopsConfigureRoles*.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
[filelog|OTHER-other2]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"OTHER",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include = env-checker.log*
exclude_fields=hostname
event_marker=^\d{2}\D{1}\d{2}\D{1}\d{4}\s\d{2}:\d{2}:\d{2}
[filelog|OTHER-other3]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"OTHER",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log
include = gfsh*.log*;HTTPPostAdapter*.log*;metagemfire*.log*;migration*.log*
exclude_fields=hostname
[filelog|OTHER-watchdog]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"OTHER",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log/vcops-watchdog
include = vcops-watchdog.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|ADAPTER-vmwareadapter]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"ADAPTER",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log/adapters/VMwareAdapter
include = *.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|ADAPTER-vcopsadapter]
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"ADAPTER",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log/adapters/VCOpsAdapter
include = *.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
[filelog|ADAPTER-openapiadapter]
tags = {"vmw_vr_ops_appname":"vROps", "vmw_vr_ops_logtype":"ADAPTER",
"vmw_vr_ops_clustername":"Cluster1", "vmw_vr_ops_clusterrole":"Master",
"vmw_vr_ops_nodename":"Node1", "vmw_vr_ops_hostname":"1.2.3.4"}
directory = /data/vcops/log/adapters/OpenAPIAdapter
include = *.log*
exclude_fields=hostname
event_marker=^\d{4}-\d{2}-\d{2}[\s]\d{2}:\d{2}:\d{2}\,\d{3}
Importing a Content pack into vRealize Log Insight
You must import the content pack into a vRealize Log Insight instance to view vRealize
Operations Manager dashboards, queries, and alerts.
Prerequisites
Verify that the vRealize Log Insight agent file is configured.
Verify that you are logged in to the vRealize Log Insight Web user interface as a user
with the Edit Admin permission. The URL format is https://log-insight-host, where loginsight-host is the IP address or host name of the vRealize Log Insight virtual appliance.
Procedure
To import a content pack, perform the following steps.
1. Log into vRealize Log insight as Admin.
2. Click the configuration drop-down menu
and select Content Packs.
3. Click the Import Content Pack button.
4. Browse to the vlcp file for the content pack and click Open.
5. Select Install as Content Pack and click Import.
Configuring vRealize Log Insight to Send Notification Events
vRealize Operations Manager content pack alerts can be sent as notification events to vRealize
Operations Manager.
Prerequisites
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
Verify that you know the IP address or host name of the target vRealize Operations
Manager instance.
Verify that you are logged in to the vRealize Log Insight Web user interface as a user
with the Edit Admin permission. The URL format is https://log-insight-host, where loginsight-host is the IP address or host name of the vRealize Log Insight virtual appliance.
Procedure
To integrate vRealize Log Insight to send alert notifications to vRealize Operations Manager,
perform the following steps.
1. Log into vRealize Log Insight as Admin.
2. Click the configuration drop-down menu icon
and select Administration.
3. Under Integration, select vRealize Operations Manager.
4. Type the IP address or host name, and user credentials for the vRealize Operations
Manager Master Node of the vRealize Operations Manager instance.
5. Select Enable alerts integration.
6. Click Test Connection.
7. Click Save.
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.com
Copyright © 2015 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
© Copyright 2024