Hey all - have LogInsight deployed in a client and hoping to use it to track HA events. They just had an ESXi host fail and HA events occur. Log into LogInsight, have the content pack installed, I can see "HA Heartbeat" info, but under "HA Events" on the dashboard there are 0. I've made sure to set the time frame within the last hour, within the last 24 hours, etc. Nothing shows.
If I go to interactive analytics and search "vSphere HA restarted" in the last 6 hours I get 18 events... which is correct.
The dashboard is set up for:
Which yields nothing.
The "VMware HA events by VM" dashboard item is defined by:
Which also yields no output.
All I am seeing is this:
Window is scaled to obscure hostnames intentionall.
Any thoughts here? This is LogInsight 4.5.1
Thanks!
Have you checked to ensure the host which failed is actually sending logs to vRLI?
Yes the host itself is sending logs:
2018-07-12T14:24:15.828Z [redacted].domain Fdm: verbose fdm[8124B70] [Originator@6876 sub=FDM opID=SWI-77188b05] [FdmService] New event: EventEx=com.vmware.vc.HA.ConnectedToMaster vm= host=host-135 tag=host-135:204067005:0
The actual HA details are reported by vCenter it seems:
2018-07-12 14:01:15.023 [redacted]vcenter.domain vcenter-server: vSphere HA restarted virtual machine Server on host redacted in cluster Boston_Cluster
Just nothing in the dashboard
Did you ever find out what was going on? We're having the same issue. Figured you might have a solution before we go digging.