LogInsight and Horizon View Content Pack

[InTheZone]

I seem to be missing the concept of how the Horizon View content pack is supposed to work since my charts are not populating even though syslog data is arriving from the connection broker at the log insight collector.

I see this information in the tech specs for the View content pack...

Tech Specs

Using the Log Insight Windows Agent, which is available for download from the Log Insight Administration --> Agents page, use this liagent.ini configuration:

[filelog|ViewMain]
directory=C:\ProgramData\VMware\VDM\logs
include=log-*.txt;debug-*.txt;pcoip_agent*.txt;pcoip_server*.txt
exclude=pcoip_perf*.txt;v4v*.log;wsnm_starts.txt

Make sure that agent is installed on the base image so that it runs on each View desktop, plus it should be installed on all the other servers as well including: ALL connection, security, & composer servers.

and looking at the content pack definition I see a number of fields with regex values defined, which are used to derive the graphs from information already in the syslog messages

example: vmw_view_agent_build = AGENTVERSION><AGENTBUILDNUM>-?\d+</AGENTBUILDNUM

...so I can't understand why would an agent be needed on the View servers and View desktops. Isn't the Log Insight agent only for pulling event logs and (I'm assuming) flat files? Given that Log Insight works with and learns from any text that has been shipped to it (in this case from syslog from the connection broker), and the fact that fields such as "appname" containing the value "view" are easy enough to examine, why would anything else be needed to populate the charts in the View content pack?

Like I said, I seem to be missing something.

Regards,

Ray

[sflanders]

The connection broker does not forward all of View's logs. Many of the logs are only available on the filesystem and Windows does not natively support syslog. This is why you need the Log Insight Windows agent and the ability to collect logs besides those that the collection broker provides. I hope this helps!

[InTheZone]

Hi Steve,

Wow, that is the fastest reply I’ve ever had! Thank you for that!

That being said however, that still doesn’t answer why even the simple charts aren’t populating. By examining the “appname” field for a value of “view” I can then examine the “hostname” field and derive a count of systems from there. The chart however is not doing that. I don’t know if a “it’s all broke until the agent is installed” approach is better than a “we’ll give you want we can without the agents running”, but it seems like as an option for places that might want to avoid an agent install the latter would be a better approach (until the View team gets syslog up to date).

As a feedback item, It would be nice if facts like your answer below were included in the write-up for the content pack. Maybe even go one step further and also have a banner in the content pack graph screen that states “the agent must be installed for full reporting to be possible” ☺

Regards,

Ray

Ray Olander, MCSE/VCP/CCNA | Systems Engineer | •Target Commercial Interiors | Minneapolis Office | Main: 612.343.0868 | Direct: 612.343.7351 | Cell: 612.250.1393

P Before printing, please think about the environment

My email has changed to ray.olander@targetinteriors.com<mailto:ray.olander@targetinteriors.com>

[sflanders]

Hey Ray,

Thanks for the feedback. I agree that at least some of the charts should populate with just the connection broker enabled. I will ensure this feedback gets incorporated in the next version of the View content pack.

[davidmirror]

Hello Ray

Do you still need this? (really delayed answer)

I had this problem also and found a way to solve it.

Please let me know

[epa80]

This may be a dumb question, and sorry for dragging up an old thread, but, what is the different between the template for "Horizon View Client" and "Horizon View Agent"? We have Log Insight 6.2 and our brokers are reporting via the broker template. We were next going to install the Agent on our linked clone guests, and assign the Agent template to them. Is that correct or would I use the client template?

Thanks in advance.