Hi
General:
I want to collect the events and tasks from our linked vCenters with LogInsight (2.0.x or 2.5). ESXi host logs don't need to be collected, because a syslog server (Splunk) is already configured and working fine. I want to collect the events and tasks from the vCenters, which aren't in the Splunk (As I know, the events and tasks are in the vcenter database)
vCenters (Ver. 5.5) are installed on Win2008 R2 servers with their database on other servers (MS SQL 2012 databases). The vCenters are in Linked Mode.
LogInsight version 2.5 has been installed in the same VLAN as the vcenters and the database servers.
It is our first installation of LogInsight, the product is fully licensed with a limited quantity of OSIs. According the admin panel of LogInsight we don't have a overcommit of licenses.
Question:
After deploying and configuring the LogInsight appliance I configured the vcenter integration in LogInsight. I unchecked the option to configure the ESXi hosts, because their logs are already on another syslog server. The events from vcenters are collected in LogInsight, but I'm missing the tasks from the vcenters
Does anyone have a clue, why the events are collected, but the tasks aren't?
Thanks in advance.
Regards
Daniel
If events are being collected then tasks are being collected. It is an all or nothing operation today. How are you confirming that tasks are not being collected? Have you tried the Tasks dashboard of the vSphere content pack? Be sure to select a time range large enough like last 24 hours. I hope this helps!
Thanks for the hints.
I tried to reconfigure the vSphere content pack (if I'm right this pack is already installed with LogInsight) but still there are no tasks in the Tasks dashboard (see attached screenshot 1)
The timerange should be wide enough
When I took a deeper look at the event entries (in Interactive Analytics pane) I saw entries which could be tasks (see attached screenshot 2)
I assume that the tasks are not been categorized correctly.
Or is my unterstanding of tasks wrong? For me the tasks are everything which is invoked by some source, like doing a vMotion or creating a vm.
Regards
Daniel
Looks like a bug in the content pack. Task events typically start with "vcenter-server: Task:" and that is what the content pack is looking for, but your example is different. Thanks for reporting. This will be fixed with the next version of the content pack. In the meantime, you can just search for taskevent like you are currently doing to get the list of tasks that were run.
Thanks for the quick answer, glad I could help find something buggy ![]()
I think I should mention, that the vCenter database has been updated serveral times. Since 4.1 we didn't made a fresh installation of the database.
Can this be a cause for this behavior?
Possible for sure. The good news is the content pack can be resilient to this, but currently is not. With the updated version it will work ![]()
Just an update that this has been fixed in the updated vSphere content pack and will be available with the next version of LI. Thanks again for the feedback!
