vRO 7.2 Log Insight Agent - how to configure vRO server to syslog?

[jauling]

I currently have in production vCO 5.5, and I've got the vCO server configured to syslog both the app and system using log4j. The vco-server log4j.xml is setup so that it sends scripting logs to my remote syslog server:

<appender name="SYSLOG" class="org.apache.log4j.net.SyslogAppender">

     <param name="Threshold" value="INFO"/>

     <param name="Facility" value="LOCAL3"/>

     <param name="SyslogHost" value="syslog-server.local:5143"/>

     <param name="FacilityPrinting" value="true"/>

     <layout class="org.apache.log4j.PatternLayout">

          <param name="ConversionPattern" value="prio:%-5p thread:%t token:%X{token} wf:%X{workflowName} wfid:%X{workflow} user: %X{username} cat:%c{1} msg:%m%n"/>

     </layout>

</appender>

<category additivity="false" name="SCRIPTING_LOG">

    <priority value="INFO" />

    <appender-ref ref="CONSOLE" />

    <appender-ref ref="FILE" />

    <appender-ref ref="SCRIPT_LOGS" />

    <appender-ref ref="SYSLOG" />

</category>

Now I'm working with vRO 7.2, and in Control Center, I've set the logging integration to Use Log Insight Agent, which I'm guessing is a replacement for log4j. Are there any docs on how to fiddle with the /etc/liagent.ini file so that I can get the same or similar results as above?

[AishR]

"Configure vRO --> control-center --> logging integration on one of the vRA virtual appliances, you can see that vRA 7.2 virtual appliance under agents in log insight..

You need to configure the LI Agent on all VAs. You can do this via the embedded vRO control center rather than editing the ini directly, but must do on each one.

You also need to download and install the agent on each IaaS windows host. When you download it from your LI host (bottom of Admin / Agents tab), it will incorporate the LI host config auto-matically.

Then push out the rest of Agent config from the LI host via Agent Groups from the Content Packs.

For more information, refer KB 2145403.

[jauling]

I don't have any vRA servers deployed. I'm using vRO directly with vCenter, then using a 3rd party syslog server which is used to aggregate logs across a bunch of different devices. Must I deploy yet another appliance to just push vRO application logs to a syslog server?

[jauling · Accepted solution]

So, I found a couple links about the Log Insight Agent, and how to configure it. I think I'll be fine now... Thanks!

VMware vRealize Log Insight 3.0 Documentation Center

VMware vRealize Log Insight 2.5 Documentation Center