Vmware Log Insight Licensing

[Eberardo Topher]

Anyonewho has ever been an administrator or operator of an IT environment can agree, it is no fun digging through logs in the middle of an issue. Even though vSphere 6.5 has a great, searchable log browser for ESXi hosts, when something is going wrong we all want to be able to quickly and easily identify the problem.

Enter VMware vRealize Log Insight, a VMware product that is often overlooked, but incredibly valuable. VMware Log Insight is the solution to the problems we know we have all had, but are usually too busy to fix. We are going to take a look at VMware vRealize log insight licensing as well, since many of us already own this amazing product thanks to a VMware licensing change wee may have missed.

My two favorite of those features are dashboards and interactive analytics. The dashboard presents you with a view of what is going in in your environment, and can get as specific as you need it too, and is fully customizable. Here is an interesting dashboard from Log Insight:

As you can see, this os an overview of authentication. There are also views for failed logins. I picked this view to show you for a couple of reasons. First, it is always a good idea to keep an eye on authentication. Sure, we all mistype a password once in a while, but if you see consistent failed logins it should be a signal to dig a little deeper into what is going on.

Secondly, this dashboard also shows many other available in the left navigation pane. These are all things we can get instant insight on with this VMware tool. For example, I may want to take a deeper look as to how DRS is running, and Log Insight makes that quick and easy for me to do.

In this case I am looking at a specific host. The use case for looking at a single host like this may be an issue with the host, such as it keeps disconnecting from vCenter. As we all know, hosts also do weird things when some sort of failure is eminent, so this is away to keep an eye on one causing trouble.

You will notice in the right hand corner of the screen there is a button for Add to Dashboard. You can add anything you come up with in Interactive Analytics right to your dashboard. You will also notice we can add as many filters as we would like to get the fully customized view we are looking for based on what is going on in our VMware vSphere environment.

When I say VMware licensing, I am talking about VMware vCenter server licensing. As we all know, vCenter Server is the brains of any large vSphere deployment, and we all already own it. VMware began bundling a 25-OSI Log Insight bundle into vCenter Server in 2016, which you can read about more in this VMware KB.

When it comes to VMware licensing, vRealize Log Insight licensing is measured by the OSI or OS Instance. You will need a vRealize Log Insight OSI for vCenter Server, ESXi hosts, Virtual Machines, and other vSphere components like NSX if you are looking to leverage the power of Log Insight.

Remember, VMware vRealize Log Isight is capable of collecting logs and performing analytics on more than just VMware vSphere. At this time, there are a staggering 73 content packs available for VMware vRealize Log Insight on the VMware Marketplace, which means many of the solutions in customer environments can benefit from vRealize Log Insight.

You can purchase additional OSI licenses in packs of 25, which is a granularity many are thrilled with. By purchasing linceces in packs of 25 instead of say 1000, we can be assured that we have not paid for VMware licenses we are not even using.

You may also need to work with operations team members and show them the new product before it is deployed. Our friends at VMware know that this is commonly encountered with many of their products, so they have provided a solution.

It is also a great learning resource for getting sone hands on experience without having to worry about impacting a production environment. For example, you may want to get used to the NSX management interface before you deploy it, or show it to other members of your team to get them on board. HOL is a great way to do this.

The 25 OSI VMware vRealize log insight licenses that come with VMware vCenter server is enough for organizations to realize the value of Log Insight before they commit to it. Log Insight is a handy tool that helps administrators and operators troubleshoot their environment quickly and easily, and is easy to get started with.

Melissa is an Independent Technology Analyst & Content Creator, focused on IT infrastructure and information security. She is a VMware Certified Design Expert (VCDX-236) and has spent her career focused on the full IT infrastructure stack.

The new VMware vSphere Foundation delivers a more simplified enterprise-grade workload platform for our mid-sized to smaller customers. This solution integrates vSphere with our intelligent operations management to provide the best performance, availability, and efficiency with greater visibility and insights.

In other words, from now on vSphere customers get Aria Operations Advanced (formerly known as vRealize Operations) and Aria Operations for Logs (formerly known as vRealize Log Insight) together with vSphere (which has vCenter and Tanzu Kubernetes Grid included).

Very important in case you missed that from the vSphere Foundation section above: Moving forward, VMware Cloud Foundation only includes NSX for network virtualization (overlay), with no more micro-segmentation or distributed firewalling (DFW) capabilities.

But, this announcement from Broadcom (Krish) was an unexpected surprise since almost everyone was expecting price increases after the acquisition. Instead, Broadcom is cutting the subscription pricing in half!

Great information. You mentioned vSAN for ROBO licensing going away. Any word on ROBO ESXi licensing? We have 20+ ROBO hosts with only 1-2 VMs each, and that will hurt to move to per-core licensing for those.

Question: If I currently have 3 Hosts with vSphere Enterprise Plus and 3 running vSphere Standard, do I have to purchase vSphere Foundation for all 6 hosts or can I buy Foundation for the 3 Hosts and Standard for the other 3?

Since there is no more vSphere Enterprise Plus standalone or vSphere Standard, you would need to buy vSphere Foundation for all 6 hosts, I guess. Except, if they are separate environments resp. clusters, you can still buy vSphere Foundation for 3 hosts, and still have the existing licenses assigned to the other 3 hosts. You can mix existing perpetual and new subscriptions licenses since the licenses are assigned on a host level.

The gateway for the network adapter wasn't correctly migrated during the conversion to Photon OS. This resulted in the upgrade appearing to hang as the appliance was unable to communicate with any system outside of its IP subnet. The issue is alluded to in the Release Notes but they're somewhat vague and lack instructions on how to check if you're affected and any workaround steps:

The issue is caused by the /etc/sysconfig/network/ifcfg-eth0 file "missing" a GATEWAY='w.x.y.z.' statement. I say "missing" as this doesn't appear to be where SLES typically saves static routes. Those are contained in the /etc/sysconfig/network/routes file, which is what the upgrade process should presumably be looking at. In our case it contained a single line specifying the default route.

in a 3 node cluster, 1 master, 2 workers. If maintenance needs to be done to the master, any kind of maintenance, is there a way to transfer the master role to another worker and then remove the ex-master node?

I am working on configuring the Arista monitoring in Log Insight and Arista Log Insight extension needs to be installed on switches to fully leverage the content pack for Arista as per the content pack instructions. Does anyone know where can I get the extension. I tried to check with the Arista TAM as well but according to them Log Insight Extension is no longer being actively developed.

I just took a look on the Content Pack Marketplace of our Log Insight environment. It mentioned 4 updates available, so I upgraded the VMware NSX vsphere, VMware -vSAN and VMware vRops 6.7+ content packs successfully, the upgrade of the VMware -vSpere 8.0 content pack was not succesful. The GUI throw this error:

we use vRealize Automation with business group as a multi-tenancy environment, we want bg's users to only access their logs on the LogInsight appliance. Can anyone point me to the correct documentation?

The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection.

We are trying to configure SSO authentication with VMWare Identity Mgr. We are getting incorrect username and password error but we are sure that username and password is correct as we tried it directly on VIDM. We even tried VIDM admin username and password too.

I am able to create a data set using the "tenant" filter, but it seems that events related to user login to vRA do not contain this attribute. They can be filtered with an extracted field "tenant_name" instead, but it seems it is not possible to use an extracted field to create a data set.

I have a vmware vcenter essentials plus license, I want to deploy vmware Insight. I've read that I dont need to purchase a license for the Insight if I need below 25-OSI, but I've tried to add the vmware vcenter plus license number to the Log Insight and does not work. Any idea?

Following guidance and using example log data from VMWare, the test data is being parsed into separate events seemingly based on line breaks in the data. Only when I wipe the line breaks does it parse the data as one event.

In one of my vm with SO: Red Hat Enterprise Linux 7 (64-bit), I have installed correctly the vrli agent, and checked in the log, the comunication is right, but if I go to me vrli Panel, this agent doesnt exists.

3a8082e126