VMware vCenter Log Insight Beta Release Notes

Released 11 JUN 2013 | Log Insight Beta Build 1168695

Last Updated: 11 JUN 2013

These release notes cover the following topics:

Introduction to Log Insight Beta

VMware vCenter Log Insight is the new solution of VMware for log management and analytics for dynamic hybrid cloud environments. It delivers superior technology for automated log management through log analytics, aggregation, and search to extend the leadership of VMware in analytics to log data. Log Insight can analyze vast amounts of unstructured machine generated data and enable interactive, real-time search and analytics through an easy to use interface providing superb time to value. It analyzes log data of all types and from all devices, enabling deep, enterprise-wide visibility. With a focus on integrated cloud operations management, and an analytics driven approach, Log Insight provides the operational intelligence needed to proactively enable service levels and operational efficiency in dynamic hybrid cloud environments.

Key Features

  • Powerful indexing for fast analytical queries

  • Intuitive easy to use Interactive Analytics user interface

  • On the fly, one-click, schema creation

  • UI driven query building

  • Flexible dashboards

  • Rate based alerting

  • Virtual appliance form factor for easy deployment and management

  • Integration with the VMware vCenter Operations Manager for complete end-to-end operations management

  • Built-in knowledge of vSphere logs

  • Support for archiving logs in compressed format

  • Easy to use administration interface

Top of Page

Before You Begin

Review this section before you begin installing and configuring Log Insight.

Virtual Appliance Deployment

  • Always use a VMware vSphere Client to connect to a VMware vCenter Server and deploy the Log Insight virtual appliance through the vCenter Server.
    The Log Insight virtual appliance should be deployed on an ESX/ESXi host version 4.0 or later that is managed by VMware vCenter Server 4.0 Update 2 or later.
  • Use the instructions provided in the VMware vCenter Log Insight Installation and Administration Guide to install and configure the Log Insight virtual appliance.
  • Licensing Log Insight 1.0 Beta

    This paragraph contains notes on licensing Log Insight 1.0 Beta

    • Log Insight 1.0 Beta comes with a default evaluation key. The license key is assigned automatically, during the deployment of the Log Insight virtual appliance.

    • In case you delete the evaluation key by accident, you can assign the key manually, by using the Log Insight Administration portal.
      1. Navigate to http://<log-insight-ip>/admin/license, where <log-insight-ip> is the IP address of the Log Insight virtual appliance.
        Ignore the certificate error and continue.
      2. Log in as the admin user.
      3. Under Management, click License.
      4. In the License Key text box, type the following key: H1019-N019J-M8L8C-0LAAM-35V6G.
      5. Click Set Key.
      6. Verify that the license status is Active, and the license type and expiry date are correct.

    Top of Page

    Compatibility Notes

    Log Insight 1.0 Beta supports the following VMware products and versions:

    • Log insight can pull events, tasks, and alarms data from VMware vCenter Server 5.1 and later.

    • ESXi hosts of the following versions can be configured to push syslog data to Log Insight: ESXi 4.1, 5.0, and 5.1

    • vCenter Server Appliance 5.1 can be configured to push data to Log Insight.

    • You can integrate Log Insight with vCenter Operations Manager as follows.
      • Log Insight can send notification events to vCenter Operations Manager 5.6, 5.7, and 5.7.1
        Note: You cannot view the details of Log Insight alerts in vCenter Operations Manager 5.6.
      • You can enable Launch in Context for Log Insight in vCenter Operations Manager 5.7.1

    Browser Support

    Log Insight 1.0 Beta supports the following browser versions.
    • Mozilla Firefox 10.x, 19.x, 20.x, and 21.0
    • Google Chrome 27.x, 26.x, and 25.x
    • Safari 6.0
    • Internet Explorer 9.x and 10.x
      Note: Internet Explorer 10 must be used in "Standards Mode". Other modes are not supported. Compatibility View is not supported.

    The minimum supported browser resolution is 1024 by 768 pixels.

    Top of Page


    Log Insight 1.0 Beta has the following limitations.
    • Log Insight does not handle non-printable ASCII characters properly.
    • Log Insight does not support multi-line messages
    • Extended regex syntax is not supported.
    • Log Insight 1.0 Beta does not provide backward compatibility to the technology preview releases of Log Insight.


    IT decision makers, architects, administrators, and others who must be aware of the security components of Log Insight must familiarize themselves with the VMware vCenter Log Insight Security Guide.

    For details on how to secure your environment, check the VMware vSphere Security guide and the VMware Security Advisories site.

    Virtual Appliance Requirements

    The following section lists the computing requirements and assumptions for the Log Insight virtual appliance.
    • Memory: 8GB RAM
    • vCPU: 2 vCPUs, 1GHz each
    • Storage space: approximately 140GB

    User Accounts

    • To pull events, tasks, and alarms data from a vCenter Server, you must provide a set of user credentials for that vCenter Server. The minimum role required to register and unregister Log Insight with a vCenter Server is Read-only, set at the vCenter Server level, and propagated to child objects .
    • The hosting vCenter Server credentials are needed to deploy the Log Insight virtual appliance.
    • The default credentials for the Log Insight Admin user are admin/<blank>. To improve security, Log Insight requires you to change these credentials when you first access the Log Insight Web user interface.
    • The default credentials for the root user on the Log Insight virtual appliance are root/<blank>. You are prompted to change the admin and root account passwords when you first access the Log Insight Administration interface.
    • To enable notification events and the launch in context functionality in a vCenter Operations Manager instance, you must provide user credentials for that vCenter Operations Manager instance.

    Top of Page

    Upgrading from a Previous Version of Log Insight

    • Log Insight 1.0 Beta does not support upgrading from technology preview versions.

    Internationalization Support

    Log Insight 1.0 has not been officially internationalized. It has been tested in English only.

    Log Insight 1.0 should work properly in non-English web browsers, as long as data input is in English.
    Following is information on use cases that have been tested.

    • The Log Insight Web user interface was accessed successfully via Chinese and German version of the Firefox browser.
    • The non-ASCII users with non-ASCII password are created and logged into the UI successfully.
    • The log bundles with non-ASCII bundle name within the non-ASCII path can be imported into Log Insight without errors.
    • The non-ASCII name for other object names, such as the Saved dashboard and the Saved Query, are created and displayed successfully.
    • The non-ASCII log contents (with various encodings, such as UTF-8, UTF-16, and native ANSI encoding) were displayed garbled on the Log Insight Web user interface.
    • Due to the issue with the garbled non-ASCII log contents, the search and filtering features for those non-ASCII log contents won't be performed.
    • The date/time format for various timestamp and calendar shown on the Log Insight user interface are in English, even though the OS and browser are in Chinese and German.
    • No Log Insight message is externalized.

    Product Documentation

    In addition to the current Release Notes, the documentation set for Log Insight 1.0 Beta includes the following deliverables.

    Top of Page

    Known Issues

    This section contains known issues for this release.


    • You can specify networking properties for the Log Insight virtual appliance only through a vCenter Server
      When you deploy the Log Insight virtual appliance, you can configure the networking properties on the vCenter Server level, but not through ESXi, Fusion, or Workstation deployment.
      Workaround: Always use a vSphere Client to connect to a vCenter Server, and deploy the virtual appliance on the vCenter Server level.


    • Log Insight might run out of disk space even though data archiving is enabled
      If the network connection to the NFS storage is slow, and the rate of the incoming data is higher than the data archiving rate, Log Insight might run out of disk space.
      Workaround: None
    • Multi-line messages that are sent to Log Insight though syslog from ESXi hosts and other applications are split incorrectly
      By default, the syslog protocol supports only single line messages, so each line of a multi-line message is sent as a separate message. This creates problems with field extractions and you cannot do proper aggregation, nor analysis on the multi-line messages.
      Workaround: None
    • You can see messages related to launch in context even if launch in context is not enabled or not supported in the vCenter Operations Manager version that you use
      The details of Log Insight notification events that appear in vCenter Operations Manager UI contain the following message that suggests using the launch in context feature:
      Log Insight found <Number> messages matching the criteria for alert "<Name of the Alert>": Use the context menu item to review the matches in Log Insight.
      This message is displayed even if you have not enabled launch in context, or if you are using vCenter Operations Manager versions earlier than 5.7.1 that do not support launch in context.
      Workaround: Ignore the message if launch in context is not enabled in your instance of vCenter Operations Manager. Open a browser and type the IP address of the Log Insight virtual appliance to search for matching messages related to the notification event.

    • The alert criticality setting for notification events is ignored in vCenter Operations Manager Custom user interface
      When, in Log Insight, you create an alert query to send notification events to vCenter Operations Manager, you can modify the level of alert criticality displayed in the Custom user interface. However, all notification events appear as Info, regardless of your settings. Workaround: None.

    • Email notifications might be dropped if you use the default SMTP settings of Log Insight
      If, in the Log Insight administration interface, you leave the default SMTP settings of localhost:25, the email notifications that Log Insight sends might be dropped by the receiving email server, such as Yahoo or Gmail.
      Workaround: Check if your email server accepts connections from localhost and configure Log Insight accordingly.

    • Unable to set the root ssh password of Log Insight in the VMware Remote Client Console (VMRC)
      If you open the VMRC from the vSphere Client or from the vSphere Web Client, if you are using a wide-area or low-bandwidth connection, the time delay over the network may be long enough to cause the virtual machine to start auto-repeat. This might prevent you from setting the root password in the VMRC console.
      Workaround: Increase the time threshold necessary for auto-repeat in the remote console. See Repeated characters when typing in remote console (KB 196).

    • You cannot change the network properties of the Log Insight virtual appliance at run time
      Log Insight does not support changing the IP address, DNS, Gateway, or Hostname of the virtual appliance at run time.
      Workaround: You must change them in vCenter vApp properties and perform a full VM shut down and then a power on.
      1. Open a vSphere Client and locate the Log Insight virtual appliance.
      2. Shut down the guest operating system of Log Insight and power off the virtual appliance.
      3. Right-click the virtual appliance, select Edit Settings, and apply the changes to network properties.
      4. Power on the virtual appliance.
        Note: You must re-enable launch in context each time you change the network properties of the Log Insight virtual appliance.
    • Accessing the HTTPS-based secure web interface at https://<loginsight-host>/generates an invalid SSL certificate warning
      By default, Log Insight installs a self-signed SSL certificate. The self-signed certificate generates security warnings when you connect to the Log Insight Web user interface.
      Workaround: You can ignore these security warnings.
      If you do not want to use a self-signed security certificate, an admin user can install a custom SSL certificate. For procedure on uploading a custom SSL certificate, see the in-product help. The use of a custom SSL certificate is optional and does not affect the features of Log Insight.
    • Restart status does not change to successful after uploading a self-signed certificate
      After a self-signed certificate has been uploaded, if you restart Log Insight from the Administration Web user interface, the restart status does not change to success even after the operation has completed.
    • In charts containing group-by values other than time, if there is a large range on the Y-axis, smaller valued bars might not be visible
      As an example, if you create a chart grouped by hostname and one host has 100,000 events, and another host has 5 events, the bar for the smaller host might be too small to be visible.
      Workaround: Hover over the bottom of the chart to view the tooltips for the small bar.
    • The maximum number of open files (4096) might be too small at first boot of the Log Insight virtual appliance
      Workaround: Reboot the Log Insight virtual appliance and restart the Log Insight service. After the restart, the maximum number of open files increases to 64000.
    • vCenter task and event collector might exit silently

    • The total number of search results is not always accurate
      The total number of results in the event results list, for example "1 to 50 out of XXXX results", is an estimation and is not always accurate. Therefore, when clicking on a bar in the chart, the number in the event results might not match the number shown in the bar. Workaround: Check the number on the Y-axis of the chart. The value on the Y-axis is always correct.

    Top of Page

    Documentation Issues

    • Links to product documentation are not functioning
      The links that point to Log Insight documentation do not work in the Log Insight Beta online help and guides.
      Workaround: Use the links to Beta documentation provided in section Product Documentation of the current release notes.
    • The information on enabling syslog feeds from ESXi hosts and vCenter Server Appliance is missing from the online help
      When you first load the Log Insight Web UI, if there is no data imported, a message shows up linking you to the online help for information about setting up syslog feeds. However, the information on configuring syslog feeds is missing from the online help.
      Workaround: Please refer to the VMware vCenter Log Insight Installation and Administration Guide.
    • The information on supported browsers is missing from the online help
      When user accesses the Log Insight Web UI from an unsupported browser or operating system, a warning message displays some information on the supported browsers without version details and point users to look at the in-product help for more details.
      Workaround: For information about supported browser versions, please refer to section Product Compatibility and Requirements of the current Release Notes.

    Top of Page