So do you want to import the logs into a database for analysis or just as a method to pass the data to your syslog host? If you want to get from ESX to the syslog you can configure the ESX(i) hosts to send the data directly.
If you're looking to get the data into a database, it might be easiest to have ESX(i) push the data to your syslog host and then pull it from there. Otherwise, you'll just have to build an import routine that deals with the log files. Samples from the 3 log files on ESXi are below. messages gets data from all three so you could just deal with that. SQL tools can parse the log to get
1) the date
2) the souce (hostd, vmkernel or vpxa
3) drop this part - [2010-08-10 20:02:24.785 24C40B90
4) import this warning 'Locale' or this verbose 'App' into error type fields
5) the rest into a free text field
You would also have to add a colum for the source host. Personally I would feed the data to the syslog server as they'll will already have a data schema defined and if you need the data else where you should be able to configure SQL Server to pull it from the syslog host.
vpxa
VM with vmid = 14 not found
Unexpected return result. Expect 1 sample, receive 2
Set internal stats for VM: 2 (vpxa VM id), 20 (vpxd VM id). Is FT primary? 0
messages
AUG 10 13:02:56 Hostd: FormatField: Invalid (vim.vm.Message.5)
AUG 10 13:02:56 Vpxa: did not find a VM with ID 14 in the vmList
AUG 10 13:02:56 Vpxa: VM with vmid = 14 not found
hostd
FormatField: Invalid (vim.vm.Message.5)
Load: Loading existing file: /etc/vmware/license.cfg
Load: Loading existing file: /etc/vmware/license.cfg
ha-license-manager:Validate -> Valid evaluation detected for "VMware ESX Server 4.0" (lastError=0, desc.IsValid:Yes)
Dave
VMware Communities User Moderator
Now available - vSphere Quick Start Guide
Do you have a system or PCI card working with VMDirectPath? Submit your specs to the Unofficial VMDirectPath HCL.
