VMware vcenter Log Insight Administration Guide

Transcription

1 VMware vcenter Log Insight Administration Guide vcenter Log Insight 2.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see EN

2 VMware vcenter Log Insight Administration Guide You can find the most up-to-date technical documentation on the VMware Web site at: The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: Copyright 2014 VMware, Inc. All rights reserved. Copyright and trademark information. VMware, Inc Hillview Ave. Palo Alto, CA VMware, Inc.

3 Contents About vcenter Log Insight Administration Guide 5 1 Administering Log Insight 7 Configure the Root SSH Password for the Log Insight Virtual Appliance 8 Change the IP Address of the Log Insight vapp 8 Assign a Permanent License to Log Insight 9 Upgrading from Previous Versions of Log Insight 9 Manage a Log Insight Cluster 12 Check the Health of the Log Insight Virtual Appliance 16 Managing User Accounts in Log Insight 18 Overview of the Log Insight Windows Agent 22 Configure Log Insight System Alerts 38 Synchronize the Time on the Log Insight Virtual Appliance 43 Configure the SMTP Server for Log Insight 44 Integrating Log Insight with Other VMware Products 44 Enable or Disable Data Archiving in Log Insight 59 Enable User Authentication Through Active Directory 59 Install a Custom SSL Certificate by Using the Log Insight Web Interface 61 Change the Default Timeout Period for Log Insight Web Sessions 64 Import a Log Insight Archive into Log Insight 64 Restart the Log Insight Service 65 Power Off the Log Insight Virtual Appliance 66 Add Memory and CPU to the Log Insight Virtual Appliance 66 Stop Sending Trace Data to VMware 67 2 Troubleshooting Log Insight 69 ESXi Logs Stop Arriving in Log Insight 69 Log Insight Runs Out of Disk Space 70 Download a Log Insight Support Bundle 71 Use the Virtual Appliance Console to Create a Support Bundle of Log Insight 71 Reset the Admin User Password 72 Reset the Root User Password 72 Alerts Could Not Be Delivered to vcenter Operations Manager 73 Unable to Log In Using Active Directory Credentials 73 SMTP does not work with STARTTLS option enabled 74 Index 75 VMware, Inc. 3

4 VMware vcenter Log Insight Administration Guide 4 VMware, Inc.

5 About vcenter Log Insight Administration Guide The VMware vcenter Log Insight Administration Guide provides information about administering Log Insight, including how to manage user accounts, integrate with other VMware products and troubleshoot common problems. Intended Audience This information is intended for anyone who wants to administer Log Insight. The information is written for experienced Windows or Linux system administrators who are familiar with virtual machine technology and datacenter operations. VMware, Inc. 5

6 VMware vcenter Log Insight Administration Guide 6 VMware, Inc.

7 Administering Log Insight 1 Administrator users can perform standard administration tasks by using the Administration section of the Log Insight Web user interface. Some changes to the configuration of Log Insight are applied only after you restart the loginsight service. Changes related to time configuration, vsphere integration, and authentication do not require restart. This chapter includes the following topics: Configure the Root SSH Password for the Log Insight Virtual Appliance, on page 8 Change the IP Address of the Log Insight vapp, on page 8 Assign a Permanent License to Log Insight, on page 9 Upgrading from Previous Versions of Log Insight, on page 9 Manage a Log Insight Cluster, on page 12 Check the Health of the Log Insight Virtual Appliance, on page 16 Managing User Accounts in Log Insight, on page 18 Overview of the Log Insight Windows Agent, on page 22 Configure Log Insight System Alerts, on page 38 Synchronize the Time on the Log Insight Virtual Appliance, on page 43 Configure the SMTP Server for Log Insight, on page 44 Integrating Log Insight with Other VMware Products, on page 44 Enable or Disable Data Archiving in Log Insight, on page 59 Enable User Authentication Through Active Directory, on page 59 Install a Custom SSL Certificate by Using the Log Insight Web Interface, on page 61 Change the Default Timeout Period for Log Insight Web Sessions, on page 64 Import a Log Insight Archive into Log Insight, on page 64 Restart the Log Insight Service, on page 65 Power Off the Log Insight Virtual Appliance, on page 66 Add Memory and CPU to the Log Insight Virtual Appliance, on page 66 Stop Sending Trace Data to VMware, on page 67 VMware, Inc. 7

8 VMware vcenter Log Insight Administration Guide Configure the Root SSH Password for the Log Insight Virtual Appliance By default the SSH connection to the virtual appliance is disabled. To enable SSH connections, you must configure the root SSH password from the VMware Remote Console. Verify that the Log Insight virtual appliance is deployed and running. 1 In the vsphere Client inventory, click the Log Insight virtual appliance, and open the Console tab. 2 Go to a command line by following the key combination specified on the splash screen. 3 In the console, type root, and press Enter. Leave the password empty and press Enter. The following message is displayed in the console: Password change requested. Choose a new password. 4 Leave the old password empty and press Enter. 5 Type a new password for the root user, press Enter, type the new password again for the root user, and press Enter. The password must consist of at least eight characters, and must include at least one upper case letter, one lower case letter, one digit, and one special character. You cannot repeat the same character more than four times. The following message is displayed: Password changed. What to do next You can use the root password to establish SSH connections to the Log Insight virtual appliance. Change the IP Address of the Log Insight vapp You can change the IP address of the Log Insight virtual appliance by editing the vapp properties in the vsphere Client. Verify that you have permissions to edit vapp properties. 1 Power off the Log Insight vapp. 2 Right-click the Log Insight vapp in the inventory and click Edit Settings. 3 Click the Options tab and select vapp Options > IP Allocation Policy. 8 VMware, Inc.

9 Chapter 1 Administering Log Insight 4 Select an IP allocation option. Option Fixed Transient DHCP Description IP addresses are manually configured. No automatic allocation is performed. IP addresses are automatically allocated using IP pools from a specified range when the vapp is powered on. The IP addresses are released when the appliance is powered off A DHCP server is used to allocate the IP addresses. The addresses assigned by the DHCP server are visible in the OVF environments of virtual machines started in the vapp. 5 (Optional) If you select Fixed, click vapp Options > Properties and assign an IP address for the Log Insight vapp. 6 Power on the Log Insight vapp. Assign a Permanent License to Log Insight You can use Log Insight only with a valid license key. You obtain an evaluation license when you download Log Insight from the VMware Web site. This license is valid for 60 days. When the evaluation license expires, you must assign a permanent license to continue using Log Insight. You use the Administration section of the Log Insight Web user interface to check the Log Insight licensing status and manage your license. Obtain a valid license key from My VMware. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. 1 Click the configuration drop-down menu icon and select Administration. 2 Under Management, select License. 3 In the License Key text box, type your license key and click Set Key. 4 Verify that the license status is Active, and the license type and expiry day are correct. Upgrading from Previous Versions of Log Insight The upgrade procedure to follow varies with the installed version of Log Insight that you want to upgrade. Installed Version Upgrade Version Upgrade Log Insight 1.0 GA and 1.5 TP1 Log Insight 1.5 GA See Upgrade Log Insight by Using CLI, on page 10. Log Insight 1.5 TP2 and later Log Insight 1.5 GA See Upgrade Log Insight 1.5 by Using the Web Interface, on page 11. Log Insight 1.5 GA Log Insight 2.0 Beta See Upgrade Log Insight 1.5 GA and later by Using the Web Interface, on page 11 and Upgrade a Worker Node in a Log Insight Cluster, on page 15 VMware, Inc. 9

10 VMware vcenter Log Insight Administration Guide Installed Version Upgrade Version Upgrade Log Insight 1.5 GA Log Insight 2.0 GA in cluster mode 1 Upgrade Log Insight 1.5 GA and later by Using the Web Interface, on page Add a Worker Node to a Log Insight Cluster, on page 12 Log Insight 2.0 Beta standalone node Log Insight 2.0 GA See Upgrade Log Insight 1.5 GA and later by Using the Web Interface, on page 11 Log Insight 2.0 Beta worker node Log Insight 2.0 GA See Upgrade a Worker Node in a Log Insight Cluster, on page 15 Upgrade Log Insight by Using CLI Because Log Insight 1.0 GA and 1.5 TP1 do not provide a user interface for upgrade, you must use a CLI to update these versions to Log Insight 1.5. For Log Insight versions 1.5 TP2 and later, use the Administration user interface for upgrades. See Upgrade Log Insight 1.5 by Using the Web Interface, on page 11. This procedure uses the virtual appliance console, but you can run it through SSH as well. NOTE All active users of the Log Insight instance are logged out during the upgrade process. Verify that you set the root user password on the Log Insight virtual appliance to enable SSH and console operations. See Configure the Root SSH Password for the Log Insight Virtual Appliance, on page 8. Create a snapshot or backup copy of the Log Insight virtual appliance. Obtain a copy of the Log Insight upgrade bundle.rpm file. 1 Download the.rpm file to a host that has SSH access to the Log Insight virtual appliance. 2 Use the secure copy protocol to copy the.rpm file to the Log Insight virtual appliance. Operating System Linux Command/Tool scp path to the RPM file/loginsight-cloudvm-version-loginsight-buildnumber.x86_64.rpm root@<loginsightiporhostname>:~ Windows For Windows systems, download an SCP client like WinSCP. 3 Use the vsphere Client console to log in to the Log Insight virtual appliance as the root user. 4 Run the service loginsight stop command. 5 Run the rpm -Uvh loginsight-cloudvm-<version>-<log-insight-build-number>.x86_64.rpm command, and wait for the upgrade to complete. 6 Run the service loginsight start command. 10 VMware, Inc.

11 Chapter 1 Administering Log Insight 7 Verify that you can log in to the Log Insight Web user interface. REMEMBER The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. If you see an error page, log in as the root user in the virtual appliance console, and run the service loginsight restart command to restart the loginsight service. Upgrade Log Insight 1.5 by Using the Web Interface Admin users can upgrade Log Insight 1.5 TP2 and later by using the administration user interface. NOTE All active users of the Log Insight instance are logged out during the upgrade process. Create a snapshot or backup copy of the Log Insight virtual appliance. Obtain a copy of the Log Insight upgrade bundle.rpm file. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. If you use Internet Explorer 9, verify that you have Adobe Flash Player installed on your system. 1 Click the configuration drop-down menu icon and select Administration. 2 Under Management, click Appliance. 3 Click Upload RPM, and browse for the.rpm file. 4 Click Upgrade. Log Insight uploads the.rpm file to the virtual appliance and displays a confirmation dialog box. 5 Click Upgrade to confirm. 6 Accept the new EULA to complete the upgrade procedure. Upgrade Log Insight 1.5 GA and later by Using the Web Interface Admin users can upgrade Log Insight 1.5 GA and later by using the administration user interface. NOTE All active users of the Log Insight instance are logged out during the upgrade process. Create a snapshot or backup copy of the Log Insight virtual appliance. Obtain a copy of the Log Insight upgrade bundle.pak file. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. If you use Internet Explorer 9, verify that you have Adobe Flash Player installed on your system. 1 Click the configuration drop-down menu icon and select Administration. VMware, Inc. 11

12 VMware vcenter Log Insight Administration Guide 2 Under Management, click Appliance. 3 Click Upload PAK, and browse to the.pak file. 4 Click Upgrade. Log Insight uploads the.pak file to the virtual appliance and displays a confirmation dialog box. 5 Click Upgrade to confirm. 6 Accept the new EULA to complete the upgrade procedure. What to do next You can deploy a new instance of the Log Insight virtual appliance and add it to the existing Log Insight node to form a cluster. The existing node becomes a master node and the newly deployed Log Insight instance becomes a worker node. See Add a Worker Node to a Log Insight Cluster, on page 12. Manage a Log Insight Cluster You can add, remove and upgrade the nodes of a Log Insight cluster by using the Log Insight Web interface. Add a Worker Node to a Log Insight Cluster Deploy a new instance of the Log Insight virtual applicance and add it to an existing Log Insight master node. 1 Deploy the Log Insight Virtual Appliance on page 12 Download the Log Insight virtual appliance. VMware distributes the Log Insight virtual appliance as an.ova file. Deploy the Log Insight virtual appliance by using the vsphere Client. 2 Join Existing Deployment on page 14 After you deploy and set up a standalone Log Insight node, you can deploy a new Log Insight instance and add it to the existing node to form a Log Insight cluster. Deploy the Log Insight Virtual Appliance Download the Log Insight virtual appliance. VMware distributes the Log Insight virtual appliance as an.ova file. Deploy the Log Insight virtual appliance by using the vsphere Client. Verify that you have a copy of the Log Insight virtual appliance.ova file. Verify that you have permissions to deploy OVF templates to the inventory. Verify that your environment has enough resources to accommodate the minimum requirements of the Log Insight virtual appliance. See the topic Minimum Requirements in the VMware vcenter Log Insight Getting Started Guide. Verify that you read and understand the virtual appliance sizing recommendations. See the topic Sizing the Log Insight Virtual Appliance in VMware vcenter Log Insight Getting Started Guide. 1 In the vsphere Client, select File > Deploy OVF Template. 2 Follow the prompts in the Deploy OVF Template wizard. 12 VMware, Inc.

13 Chapter 1 Administering Log Insight 3 On the Deployment Configuration page, select the size of the Log Insight virtual appliance based on the size of the environment for which you intend to collect logs. Small is the minimum requirement for production environments. Option Log Ingest Rate vcpus Memory IOPS Syslog Connections Events per Second Extra Small 3GB/day 2 4GB Small 15GB/day 4 8GB Medium 37.5GB/day 8 16GB Large 112.5GB/day 16 32GB NOTE If you select Large, you must upgrade the virtual hardware on the Log Insight virtual machine after the deployment. 4 On the Disk Format page, select a disk format. Thick Provision Lazy Zeroed creates a virtual disk in a default thick format. Space required for the virtual disk is allocated when the virtual disk is created. The data remaining on the physical device is not erased during creation, but is zeroed out on demand at a later time, on first write from the virtual appliance. Thick Provision Eager Zeroed creates a type of thick virtual disk that supports clustering features such as Fault Tolerance. Space required for the virtual disk is allocated at creation time. In contrast to the flat format, the data remaining on the physical device is zeroed out when the virtual disk is created. it might take much longer to create disks in this format than to create other types of disks. IMPORTANT Deploy the Log Insight virtual appliance with thick provisioned eager zeroed disks whenever possible for better performance and operation of the virtual appliance. Thin Provision creates a disk in thin format. The disk grows as the data saved on it grows. If your storage device does not support thick provisioning disks or you want to conserve unused disk space on the Log Insight virtual appliance, deploy the virtual appliance with thin provisioned disks. NOTE Shrinking disks on the Log Insight virtual appliance is not supported and might result in data corruption or data loss. 5 (Optional) On the Properties page, set the networking parameters for the Log Insight virtual appliance. If you do not provide network settings, such as IP address, DNS servers, and gateway, Log Insight utilizes DHCP to set those settings. CAUTION Do not specify more than two domain name servers. If you specify more than two domain name servers, all configured domain name servers are ignored in the Log Insight virtual appliance. Use comma to separate domain name servers. 6 (Optional) On the Properties page, set the root password for the Log Insight virtual appliance. 7 Follow the prompts to complete the deployment. For information on deploying virtual appliances, see the User's Guide to Deploying vapps and Virtual Appliances. After you power on the virtual appliance, an initialization process begins. The initialization process takes several minutes to complete. At the end of the process, the virtual appliance restarts. VMware, Inc. 13

14 VMware vcenter Log Insight Administration Guide 8 Navigate to the Console tab and check the IP address of the Log Insight virtual appliance. IP Address Prefix Description The DHCP configuration on the virtual appliance is correct. The DHCP configuration on the virtual appliance failed. a Power off the Log Insight virtual appliance. b Right-click the virtual appliance and select Edit Settings. c Set a static IP address for the virtual appliance. What to do next To enable SSH connections to the Log Insight virtual appliance, configure the root password in the virtual appliance console. See topic Configure the Root SSH Password for the Log Insight Virtual Appliance in the Log Insight Administration Guide. If you want to configure a standalone Log Insight deplpyment, see topic Configure New Log Insight Deployment in the Log Insight Getting started Guide. The Log Insight Web interface is available at where log-insight-host is the IP address or host name of the Log Insight virtual appliance. Join Existing Deployment After you deploy and set up a standalone Log Insight node, you can deploy a new Log Insight instance and add it to the existing node to form a Log Insight cluster. Log Insight can scale out by using multiple virtual appliance instances. This enables linear scaling of the ingestion throughput, increases query performance and allows for ingestion high availability. In cluster mode, Log Insight provides master and worker nodes. Both master and worker nodes are responsible for a subset of data. Master nodes can query all subsets of data and aggregate the results. In the vsphere Client, note the IP address of the worker Log Insight virtual appliance. Verify that you have the IP address or host name of the master Log Insight virtual appliance. Verify that you have an administrator account on the master Log Insight virtual appliance. For information on supported browser versions, see the topic Minimum Requirements in the VMware vcenter Log Insight Getting Started Guide. 1 Use a supported browser to navigate to the Web user interface of the Log Insight worker. The URL format is where log_insight-host is the IP address or host name of the Log Insight worker virtual appliance. The initial configuration wizard opens. 2 Click Join Existing Deployment. 3 Enter the IP address or host name of the Log Insight master and click Go. The worker sends a request to the Log Insight master to join the existing deployment. 4 Click the Click here to access the Cluster Management page link. 5 Log in as an administrator. The Cluster page loads. 14 VMware, Inc.

15 Chapter 1 Administering Log Insight 6 Click Allow. The worker joins the existing deployment and Log Insight begins to operate in a cluster. What to do next To add another worker, deploy a new Log Insight instance and add it to the cluster using the startup wizard. Upgrade a Worker Node in a Log Insight Cluster You can upgrade one or more worker nodes in a Log Insight cluster. The Log Insight master node updates worker nodes centrally through the Web user interface. Create a snapshot or backup copy of the Log Insight virtual appliance. Obtain a copy of the Log Insight upgrade bundle.pak file. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. If you use Internet Explorer 9, verify that you have Adobe Flash Player installed on your system. Upgrade the master node of the Log Insight cluster. See Upgrade Log Insight 1.5 GA and later by Using the Web Interface, on page 11. If you use an external load balancer, take the node off the balancer before you put it in maintenance mode. 1 Click the configuration drop-down menu icon and select Administration. 2 Under Configuration, click Cluster. 3 In the Workers table, find the the node you want, click The node is now in maintenance mode., and click Continue. NOTE A node in maintenance mode continues to receive logs. 4 Click and then click Upgrade worker to confirm. NOTE The icon is only available for workers that run earlier versions than the master. The icon is not visible after the worker successfully upgrades to the version of the master. When the upgrade completes, the worker restarts and reconnects to the cluster. What to do next Upgrade the remaining worker nodes in your Log Insight cluster. VMware, Inc. 15

16 VMware vcenter Log Insight Administration Guide Remove a Worker Node from a Log Insight Cluster You can remove a worker node from a Log Insight cluster and add it to a different clyster or start a standalone deployment. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. If you use an external load balancer, take the node off the balancer before you put it in maintenance mode. 1 Click the configuration drop-down menu icon and select Administration. 2 Under Configuration, click Cluster. 3 In the Workers table, find the the node you want, click The node is now in maintenance mode., and click Continue. NOTE A node in maintenance mode continues to receive logs. 4 Click to remove the node. Log Insight removes the node from the cluster and sends out an notification. Example: What to do next Navigate to the Web user interface of the removed node to configure it. You can add the node to different existing Log Insight cluster or start a new standalone deployment. Check the Health of the Log Insight Virtual Appliance You can check available resources and active queries on the Log Insight virtual appliance, and view current statistics about the operation of Log Insight. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. 1 Click the configuration drop-down menu icon and select Administration. 2 Under Management, click System Monitor. 3 If Log Insight is running as a cluster, click Show resources for and choose the node you want to monitor. 16 VMware, Inc.

17 Chapter 1 Administering Log Insight 4 Click the buttons on the System Monitor page to view the information that you need. Option Resources Active Queries Statistics Description View information about the CPU, memory, IOPS (read and write activity), and storage usage on the Log Insight virtual appliance. The charts on the right represent historical data for the last 24 hours, and are refreshed at five-minute intervals. The charts on the left display information for the last five minutes, and are refreshed every three seconds. View information about the queries that are currently active in Log Insight. View statistics about the log ingest operations and rates. To view more detailed statistics, click Show advanced statistics. What to do next You can use the information from the System Monitor page to manage resources on the Log Insight virtual appliance. Log Storage Policy The Log Insight virtual appliance uses a minimum of 100GB of storage for incoming logs. When the volume of logs imported into Log Insight reaches the 100GB limit, old log messages are automatically and periodically retired on a first-come-first-retired basis. To preserve old messages, you can enable the archiving feature of Log Insight. See Enable or Disable Data Archiving in Log Insight, on page 59. Data stored by Log Insight is immutable. After a log has been imported, it cannot be removed until it is automatically retired. Increase the Storage Capacity of the Log Insight Virtual Appliance You can increase the storage resources allocated to Log Insight as your needs grow. You increase the storage space by adding a new virtual disk to the Log Insight virtual appliance. You can add as many disks as you need, and as your environment permits. Log in to the vsphere Client as a user who has privileges to modify the hardware of virtual machines in the environment. Shut down the Log Insight virtual appliance safely. See Power Off the Log Insight Virtual Appliance, on page In the vsphere Client inventory, right-click the Log Insight virtual machine and select Edit Settings. 2 On the Hardware tab, click Add. 3 Select Hard Disk and click Next. VMware, Inc. 17

18 VMware vcenter Log Insight Administration Guide 4 Select Create a new virtual disk and click Next. a b Type the disk capacity. Select a disk format. Option Thick Provision Lazy Zeroed Thick Provision Eager Zeroed Thin Provision Description Creates a virtual disk in the default thick format. The space required for the virtual disk is allocated when the virtual disk is created. The data residing on the physical device is not erased during creation, but is zeroed out on demand at a later time, after first write from the virtual appliance Creates a type of thick virtual disk that supports clustering features such as Fault Tolerance. The space required for the virtual disk is allocated at creation time. In contrast to the flat format, the data residing on the physical device is zeroed out when the virtual disk is created. it might take much longer to create disks in this format than to create other types of disks. Create thick provisioned eager zeroed disks whenever possible for better performance and operation of the Log Insight virtual appliance. Creates a disk in thin format. Use this format to save storage space. NOTE Snapshots can negatively affect the performance of a virtual machine. Do not use snapshots whenever possible. c (Optional) To select a datastore, browse for the datastore location and click Next. 5 Accept the default virtual device node and click Next. 6 Review the information and click Finish. 7 Click OK to save your changes and close the dialog box. When you power on the Log Insight virtual appliance, the virtual machine discovers the new virtual disk and automatically adds it to the default data volume. CAUTION After you add a disk to the virtual appliance, you cannot remove it safely. Removing disks from the Log Insight virtual appliance may result in complete data loss. Managing User Accounts in Log Insight Administrators can create user accounts to provide users with access to the Log Insight Web interface. The current version of Log Insight supports two user roles, Normal user and Admin user. Only administrator users can create and edit all user accounts. Normal users can modify their own accounts to change their or account password. Create a New User Account in Log Insight Administrators can create user accounts to provide access to the Log Insight Web user interface. The current version of Log Insight supports two user roles, Normal user and Admin user. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. 18 VMware, Inc.

19 Chapter 1 Administering Log Insight 1 Click the configuration drop-down menu icon and select Administration. 2 Under Management, click Users. 3 Click New User. 4 In the Authentication Method drop-down menu, select Default (built-in). 5 Type a user name and address. The address is optional. 6 From the Role drop-down menu, select the user role. Option Normal User Admin Description Normal users can access the full functionality of Log Insight to view log events, run queries to search and filter logs, import content packs into their own user space, add alert queries, and manage their own user accounts to change their password or address. Normal users do not have access to the administration options, cannot share content with other users, cannot modify the accounts of other users, and cannot install a content pack as a content pack. Admin users can access the full functionality of Log Insight, can administer Log Insight, and can manage the accounts of all other users. 7 Copy the password from the Password text box and provide it to the user. 8 Click Save. Add an Active Directory User to Log Insight You can allow active directory users (AD) to log in to Log Insight by using their domain credentials. When you enable AD support in Log Insight, you configure a domain name and provide a binding user that belongs to the domain. Log Insight uses the binding user to verify the connection to the AD domain, and to verify the existence of AD users and groups. The AD users that you add to Log Insight must either belong to the domain of the binding user, or to a domain that trusts the domain of the binding user. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. Verify that you configured the AD support. See Enable User Authentication Through Active Directory, on page Click the configuration drop-down menu icon and select Administration. 2 Under Management, click Users. 3 Click New User. 4 From the Authentication Method drop-down menu, select Active Directory. The default domain name that you specified when you configured AD support appears in the Domain text box. If you are adding users from the default domain, do not modify the domain name. VMware, Inc. 19

20 VMware vcenter Log Insight Administration Guide 5 (Optional) If you want to add a user from a domain that trusts the default domain, type the name of the trusting domain in the Domain text box. 6 Type the name of a domain user. 7 From the Role drop-down menu, select the user role. Option Normal User Admin Description Normal users can access the full functionality of Log Insight to view log events, run queries to search and filter logs, import content packs into their own user space, add alert queries, and manage their own user accounts to change their password or address. Normal users do not have access to the administration options, cannot share content with other users, cannot modify the accounts of other users, and cannot install a content pack as a content pack. Admin users can access the full functionality of Log Insight, can administer Log Insight, and can manage the accounts of all other users. 8 Click Save. Log Insight verifies whether the user exists in the domain that you specified or in its trusted domains. If the user does not exist, a dialog box informs you that Log Insight cannot verify that user. You can save the user without verification or cancel and correct the user name. AD users that you add can use their domain credentials to log in to Log Insight. Add an Active Directory Group to Log Insight Instead of adding individual domain users, you can add domain groups to allow users to log in to Log Insight. When you enable AD support in Log Insight, you configure a domain name and provide a binding user that belongs to the domain. Log Insight uses the binding user to verify the connection to the AD domain, and to verify the existence of AD users and groups. The AD groups that you add to Log Insight must either belong to the domain of the binding user, or to a domain that is trusted by the domain of the binding user. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. Verify that you configured the AD support. See Enable User Authentication Through Active Directory, on page Click the configuration drop-down menu icon and select Administration. 2 Under Management, click Users. 3 Under Active Directory Groups, click New Group. The default domain name that you specified when you configured AD support appears in the Domain text box. If you are adding groups from the default domain, do not modify the domain name. 4 (Optional) If you want to add a group from a domain that trusts the default domain, type the name of the trusting domain in the Domain text box. 5 Type the name of the AD group that you want to add. 20 VMware, Inc.

21 Chapter 1 Administering Log Insight 6 From the Role drop-down menu, select the user role. Option Normal User Admin Description Normal users can access the full functionality of Log Insight to view log events, run queries to search and filter logs, import content packs into their own user space, add alert queries, and manage their own user accounts to change their password or address. Normal users do not have access to the administration options, cannot share content with other users, cannot modify the accounts of other users, and cannot install a content pack as a content pack. Admin users can access the full functionality of Log Insight, can administer Log Insight, and can manage the accounts of all other users. 7 Click Save. Log Insight verifies whether the AD group exists in the domain that you specified or in a trusting domain. If the group cannot be found, a dialog box informs you that Log Insight cannot verify that group. You can save the group without verification or cancel to correct the group name. Users that belong to the AD group that you added can use their domain account to log in to Log Insight and have the same level of permissions as the group to which they belong. Modify a User Account in Log Insight A Log Insight administrator can change the user account type and reset their passwords. All users can change their addresses and passwords. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. 1 Click the configuration drop-down menu icon and select Administration. 2 Under Management, select Users. 3 Select the user account that you want to modify and click the Edit icon. 4 Modify the parameters of the account and click Save. NOTE The modified user permissions are applied the next time a user logs in. If a user is logged in while you apply changes to their account, your changes are not applied until the user logs out and logs in again. Delete a User Account from Log Insight You can delete user accounts by using the Log Insight Administration user interface. Verify that you are logged in to the Log Insight Web user interface as an Admin user. The URL format is where log-insight-host is the IP address or host name of the Log Insight virtual appliance. 1 Click the configuration drop-down menu icon and select Administration. VMware, Inc. 21

22 VMware vcenter Log Insight Administration Guide 2 Under Management, click Users. 3 Select the check box beside the user name that you want to delete. 4 Click the Delete icon. Overview of the Log Insight Windows Agent The Log Insight Windows Agent collects events from Windows event channels and log files, and forward them to the Log Insight server. A Windows event channel is a pool for collecting related events in a Windows system. By default the Log Insight Windows Agent collects events from the Application, System, and Security channels. In a Windows system, applications can store log data in flat text files on the file system. The Log Insight Windows Agent can monitor directories and collect events from flat text log files. The Log Insight Windows Agent has a limit of 64 KB per request to the Log Insight server. The Log Insight Windows Agent runs as a Windows service and starts immediately after installation. During and after installation, you can configure the following options for the Log Insight Windows Agent: Select the target Log Insight server to which the Log Insight Windows Agent forwards events. Select the communication protocol and port that the Log Insight Windows Agent uses. Add additional Windows event channels from which the Log Insight Windows Agent collects events to. Select Windows directories to monitor and add flat log files to collection. The Log Insight Windows Agent requires Windows Vista or later, or Windows Server 2008 or later. To download the Log Insight Windows Agent.msi file, navigate to the Administration page of the Log Insight Web user interface, in the Management section, click Agents, and click the Download Log Insight Windows agent link. Install the Log Insight Windows Agent with Default Configuration Install the Log Insight Windows Agent with default configuration by using the GUI wizard. Verify that you have a copy of the Log Insight Windows Agent.msi file.to download the Log Insight Windows Agent.msi file, navigate to the Administration page of the Log Insight Web user interface, in the Management section click Agents, and click the Download Log Insight Windows agent link. Verify that you have permissions to perform installations and start services on the Windows machine. 1 Log in to the Windows machine on which you want to install the Log Insight Windows Agent. 2 Change to the directory where you have the Log Insight Windows Agent.msi file. 3 Double-click the Log Insight Windows Agent.msi file, accept the terms of the License Agreement, and click Next. 4 Enter the IP address or host name of the Log Insight server and click Install. The wizard installs the the Log Insight Windows Agent as an automatic Windows Service under the LocalSystem service account. 5 Click Finish. 22 VMware, Inc.

23 Chapter 1 Administering Log Insight What to do next Configure the Log Insight Windows Agent by editing liagent.ini file. See topic related to the Log Insight Windows Agent configuration in the Log Insight Administration Guide Install the Log Insight Windows Agent with Parameters Install the Log Insight Windows Agent by using the Windows Command Prompt and provide configuration parameters. For MSI command-line options, see the Microsoft Developer Network (MSDN) Library Web site and search for MSI command-line options. Verify that you have a copy of the Log Insight Windows Agent.msi file.to download the Log Insight Windows Agent.msi file, navigate to the Administration page of the Log Insight Web user interface, in the Management section click Agents, and click the Download Log Insight Windows agent link. Verify that you have permissions to perform installations and start services on the Windows machine. If you use the silent installation options /quiet or /qn, verify that you run the installation as an administrator. If you run silent installation as a non-administrator, the installation will not prompt for administrator privileges and will fail. Use the logging option and parameters /lxv* file_name for diagnostic purposes. 1 Log in to the Windows machine on which you want to install the Log Insight Windows Agent. 2 Open a Command Prompt window. 3 Change to the directory where you have the Log Insight Windows Agent.msi file. 4 Run the following command : Drive:\path-to-msi_file>VMware-vCenter-Log-Insight-Agent-*.msi and replace * with your version and build number. 5 (Optional) Specify a user service account under which the Log Insight Windows Agent service will run. Drive:\path-to-msi_file>VMware-vCenter-Log-Insight-Agent-*.msi SERVICEACCOUNT=.\user SERVICEPASSWORD=user_password NOTE The account supplied in the SERVICEACCOUNT parameter must have the Log On As a Service privilege and full write access to %ProgramData%\VMware\Log Insight Agent directory for the installer to execute correctly. If you do not specify a SERVICEACCOUNT parameter, the Log Insight Windows Agent service is installed under the LocalSystem service account. VMware, Inc. 23

24 VMware vcenter Log Insight Administration Guide 6 (Optional) Enter the Log Insight server, port, and protocol. Parameter SERVERHOST SERVERPROTO SERVERPORT Description The IP address or host name of the Log Insight virtual appliance. The protocol that the Log Insight Windows Agent uses to send events to the Log Insight server. The possible values are cfapi and syslog. VMware recommends using the default cfapi setting. The port number depends on the value of SERVERPROTO. The default value for SERVERPORT is 9000, which corresponds to the default SERVERPROTO=cfapi. Use SERVERPORT=514 for SERVERPROTO=syslog. The command-line parameters correspond to hostname, proto, and port in the [server] section of the liagent.ini file. 7 Press Enter. The command installs the Log Insight Windows Agent as a Windows service. The Log Insight Windows Agent service starts automatically when you start the Windows machine. What to do next Verify that the command-line parameters you set are applied correctly in the liagent.ini file. See Configure the Log Insight Windows Agent After Installation, on page 24. Configure the Log Insight Windows Agent After Installation You can configure the Log Insight Windows Agent after the installation. You must edit the liagent.ini file to configure Log Insight Windows Agent to send events to a Log Insight server of your choice, set communication protocol and port, add Windows event channels, and configure flat file log collection. Default Configuration of the Log Insight Windows Agent After installation, the liagent.ini file contains preconfigured default settings for the Log Insight Windows Agent. liagent.ini Default Configuration [server] proto=cfapi hostname=loginsight port=9000 ; Force agent reconnection every 30 minutes. reconnect=30 [storage] max_disk_buffer=200 [winlog Application] channel=application [winlog Security] channel=security [winlog System] channel=system 24 VMware, Inc.

25 Chapter 1 Administering Log Insight Parameter Value Description proto cfapi The protocol that the Log Insight Windows Agent uses to send events to the Log Insight server. The possible values are cfapi and syslog. VMware recommends using the default cfapi setting. hostname LOGINSIGHT The IP address or host name of the Log Insight virtual appliance. port 9000 The communication port that Log Insight Windows Agent uses to send events to the Log Insight server. The default values are 9000 for cfapi and 514 for syslog max_disk_buffer 200 The maximum disk space in MB that the Log Insight Windows Agent uses to buffer events and its own logs. channel Application, Security, System The default Windows Event Log channels that the Log Insight Windows Agent collects. See Collect Events from Windows Events Channels, on page 26 Set Target Log Insight Server You can set or change the target Log Insight server that the Log Insight Windows Agent sends event to, if you have not set the values during the installation process. Log in to the Windows machine on which you installed the Log Insight Windows Agent and start the Services manager to verify that the VMware vcenter Log Insight Agent service is installed. 1 Navigate to the program data folder of the Log Insight Windows Agent. %ProgramData%\VMware\Log Insight Agent 2 Open the liagent.ini file in any text editor. 3 Modify the following parameters and set the values for your environment. Parameter proto hostname port Description The protocol that the Log Insight Windows Agent uses to send events to the Log Insight server. The possible values are cfapi and syslog. VMware recommends using the default cfapi setting. The IP address or host name of the Log Insight virtual appliance. The communication port that Log Insight Windows Agent uses to send events to the Log Insight server. The default values are 9000 for cfapi and 514 for syslog [server] proto=server_protocol hostname=loginsight_host port=port_number 4 Save and close the liagent.ini file. VMware, Inc. 25

26 VMware vcenter Log Insight Administration Guide 5 Restart the VMware Log Insight Agent service. NOTE Any change you make to the liagent.ini file requires a restart of the VMware Log Insight Agent service for the configuration change to take effect. Example: Configuration [server] proto=cfapi hostname=loginsight port=9000 Collect Events from Windows Events Channels You can add a Windows event channel to the Log Insight Windows Agent configuration. The Log Insight Windows Agent will collect the events and send them to the Log Insight server. Log in to the Windows machine on which you installed the Log Insight Windows Agent and start the Services manager to verify that the VMware vcenter Log Insight Agent service is installed. 1 Navigate to the program data folder of the Log Insight Windows Agent. %ProgramData%\VMware\Log Insight Agent 2 Open the liagent.ini file in any text editor. 3 Add the following parameters and set the values for your environment. Parameter [winlog section_name] channel enabled tags whitelist, blacklist Description A unique name for the configuration section. The full name of the event channel as shown in the Event Viewer built-in Windows application. To copy the correct channel name, right-click a channel in Event Viewer, select Properties and copy the contents of Full Name field. An optional parameter to enable or disable the configuration section. The possible values are yes or no. The default value is yes. An optional parameter to add custom tags to the fields of collected events. Define tags using JSON notation. Tag names can contain letters, numbers, and underscores. A tag name can only begin with a letter or an underscore and cannot exceed 64 characters. Tag names are not case sensitive. For example, if you use tags={"tag_name1" : "tag value 1", "Tag_Name1" : "tag value 2" }, Tag_Name1 will be ignored as a duplicate. You cannot use event_type and timestamp as tag names. Any duplicates within the same declaration are ignored. Optional parameters to explicitly include or exclude log events. [winlog section_name] channel=event_channel_name enabled=yes_or_no tags={"tag_name1" : "Tag value 1", "tag_name2" : "tag value 2" } 26 VMware, Inc.

27 Chapter 1 Administering Log Insight 4 Save and close the liagent.ini file. 5 Restart the VMware Log Insight Agent service. NOTE Any change you make to the liagent.ini file requires a restart of the VMware Log Insight Agent service for the configuration change to take effect. Example: Configurations [winlog Events_Firewall ] channel=microsoft-windows-windows Firewall With Advanced Security/Firewall enabled=no [winlog custom] channel=custom tags={"channeldescription": "Events testing channel"} Set up Windows Event Channel Filtering You can set up filters for Windows Event Channels to explicitly include or exclude log events. You use the whitelist and blacklist parameters to evaluate a filter expression. The filter expression is a Boolean expression that consists of Windows event fields and operators. whitelist collects only log events for which the filter expression evaluates to non-zero. If you omit whitelist, the value is an implied 1. blacklist excludes log events for which the filter expression evaluates to non-zero. The default value is 0. For a complete list of Windows event fields and operators see Event Fields and Operators, on page 28 Log in to the Windows machine on which you installed the Log Insight Windows Agent and start the Services manager to verify that the VMware vcenter Log Insight Agent service is installed. 1 Navigate to the program data folder of the Log Insight Windows Agent. %ProgramData%\VMware\Log Insight Agent 2 Open the liagent.ini file in any text editor. 3 Add a whitelist or blacklist parameter in the [winlog ] section. For example [winlog unique_section_name] channel = event_channel_name blacklist = filter_expression 4 Create a filter expression from Windows events fields and operators. For example whitelist = level > WINLOG_LEVEL_SUCCESS and level < WINLOG_LEVEL_INFO 5 Save and close the liagent.ini file. 6 Restart the VMware Log Insight Agent service. NOTE Any change you make to the liagent.ini file requires a restart of the VMware Log Insight Agent service for the configuration change to take effect. VMware, Inc. 27