NSX - Log Insight

[rajeevsrikant]

I need below queries regarding Log Insight for NSX

1. How to do the sizing for the Log Insight server ? Any reference article which helps in sizing ?

2. Is 1 server sufficient for the Log Insight considering NSX content pack ?

3. Will ESXi logs be analyzed & monitored if I have only NSX Content pack ?

[Sreejesh_D]

hi,

1. Please find the loginsight sizing calculator here. http://www.vmware.com/go/loginsight/calculator

2. Its upto the number of NSX instances and the overall events genrated. The calculator can give an approximate projection.

3. vSphere support is default in loginsight.

[rajeevsrikant]

Thanks.

So my understanding is that with NSX Content Pack, I will also be able to send my ESXi logs to Log Insight & it is included in the default license of NSX Content pack.

[Sreejesh_D]

loginsight by default ship with content pack for vsphere (vCenter and ESXI). NSX content pack is an add on which will help to colelct logs from NSX

please refer Vsx

[rajeevsrikant]

Thanks. Got it.

Does Log Insight supports SNMP ?

Can it send SNMP trap information or details to any SNMP Manager device ?

[rajeevsrikant]

The below article says VMware provides Log Insight for vCenter & ESXi free for only 25 OSI.

FAQ: Log Insight for vCenter Server (2144909) | VMware KB

So if there are more than 25 , then additional license needs to be purchased.

If it is not same like NSX Log Insight Content pack, which follows the NSX licensing.

Ex - If I have 60 NSXs license for 30 hosts (2 CPU per host) then i am entitled to use NSX Content Pack for free for all the 25 hosts for NSX monitoring.

But In case of Log Insight for vSphere even though I have licenses for 25 hosts I need to buy additional license for the remaining 5 hosts.

Let me know if my above understanding is right.

[rajeevsrikant]

Any inputs ?

Does Log Insight supports SNMP ?

[rajeevsrikant]

Any inputs please ?

Does Log Insight supports SNMP & SNMP traps ?

[bayupw]

That 25 OSI is coming from vCenter Server license.

However, if you have NSX then you can refer to this KB: vRealize Log Insight for NSX FAQ (2145800) | VMware KB

• NSX Standard, Advanced & Enterprise: 1 Log Insight Standard CPU for every NSX CPU
• NSX Term Standard, Advanced & Enterprise: 1 Log Insight Standard CPU for every NSX Term CPU, but expires on date in license
• NSX for Desktop Advanced & Enterprise: 1 Log Insight Standard CPU for every 50 CPU of NSX Desktop

Depending on your ESXi hosts, NSX CPU licenses and features required; you may not need to buy additional Log Insight licenses.

[rajeevsrikant]

Thanks bayupw​

But would like to clarify does Log Insight supports SNMP ?

Does it generate SNMP traps for any alerts or events which gets trigger.

[Techstarts]

SNMP traps are generated by end point in this case ESXI host, vCenter and etc.  while Log Insight is logging solution. As long as logs are forward to vLSI you are okay.

What is the purpose of SNMP in your infrastructure in relationship with vLSI?

[Techstarts]

Thanks bayu​. I was pleased to see vLSI is free with NSX.

[bayupw]

No support at the moment, discussed in this thread vRealize Log Insight 3.0 + SNMP

Correct Answer by acastonguay on Dec 20, 2015 7:08 AM

Native support for receiving SNMP traps does not exist today. You can vote for the feature request Send and Receive SNMP traps .

If source SNMP traps can be converted to Syslog or log files externally, you can ingest them into Log Insight 3.0. For example, see syslog-ng 3.0 and SNMP traps « Bazsi's blog.

If you are looking for SNMP traps for NSX, it is supported per NSX 6.2.3

VMware NSX for vSphere 6.2.3 Release Notes

• SNMP Support: Configure SNMP traps for events from NSX Manager, NSX Controller, and Edge.

[rajeevsrikant]

The reason I am looking for SNMP is for the below reasons.

1 - In case of any alerts or triggers instead of only syslog we would like to receive the notifications via SNMP trap.

2 - We already have SNMP managers to which the SNMP trap details needs to be sent.

The other question is that from NSX version 6.2.3 SNMP is available.

So in this case what will be the difference in having Log Insight vs enabling SNMP traps for any issues or alerts.

Also I found the below article which says that Log Insight to be integrated with vRealize Opeations.

From this I am not able to really understand what is the purpose of this & the advantage of this.

3 Reasons Why You Should Integrate Log Insight with vRealize Operations - VMware Cloud Management

[rajeevsrikant]

Any inputs