vSphere Integration, and vCenter logging Question

[thepj]

Good Morning,

Few questions!

1. Does the vSphere Integration with the vCenter servers provide any additional functionality over just pulling all the logs from vCenter through a syslog collector?
2. Do you see any issue with using either nxlog or the Log Insight Agent to pull the following logs listed below, even though they are being written do quite constantly? (Such as file permission or in use errors)
3. Would there be any issue removing the vcenter/host integration into Log Insight and utilize a separate method of sending logs in to Log Insight?
4. How would the Log Insight Agent handle the files that would have dynamic names? Could I just say log catalina.*.log?
   1. VMware KB:    Location of vCenter Server log files 

      1. vpxd.log

      2. vpxd-profiler.log

      3. vpxd-alert.log

      4. cim-diag.log and vws.log

      5. ls.log

      6. vimtool.log

      7. stats.log

      8. sms.log

      9. eam.log

      10. catalina.<date>.log and localhost.<date>.log

      11. jointool.log

      12. manager.<date>.log

      13. host-manager.<date>.log

          Thanks for any help!

          - Patrick

[sflanders · Accepted solution]

1. vSphere integration for vCenter Server is only to pull events, tasks, and alarms from the vCenter Server database and ingest as though they were log messages

2. All should be fine - use the Log Insight agent

3. Currently no - notice the currently

4. Yes, the Log Insight agent support file name globbing (* and ?) - see Collect Events from a Log File

[thepj]

Would this work successfully?

[filelog|vCenter-Logs]

directory=C:\ProgramData\VMware\VMware VirtualCenter\Logs

include=*.log

exclude=*.log.gz

[sflanders]

Should not even need the exclude given the include, but yes.

[thepj]

I saw in the documentation that the include was "optional", what would it pull if I didn't tell it what to include?

[sflanders]

*, which means all files are collected in directory. If you do *.log then blah.log WILL be collected, but blah.log.gz WILL NOT. If you had blah.log, blah.log.1, blah.log.2.gz then if you wanted the first two you would use *.log.* for include and then you would NEED to exclude *.log.*.gz. I hope this helps!

[thepj]

It does, however, would it parse a gzip? Is Log Insight smart enough that it would use one of the "z" *nic commands such as zcat to read what is inside of it? Or would it just not be able to see what is in it and ignore that.

[sflanders]

It would be ignored. A better example would be blah.log, blah.1.log, blah.2.log and you only want to collect blah.log. You could use include=*.log exclude=*.*.log