Install VMware vRealize Log Insight 4.3

April 5, 2017 virtuadmin

In this post, I wanted to walk through the deployment of VMware vRealize Log Insight 4.3. I had heard about this product in the past but had never gotten to leverage its capabilities. If you are like me, parsing through piles of logs may not be one of your favorite pastimes, especially in a crunch. Well, VMware aims to fix that with Log Insight.

As per VMware, Log Insight is log collector and analyzer that enables faster and more efficient troubleshooting across your environment. It works by ingesting unstructured machine-generated data and providing structure. Admins can search, aggregate, and visualize datasets to quickly analyze their environment.

Another item worth noting is that log Insight isn’t just for VMware products; it is a universal log manager. If a device’s logs are in syslog format, Log Insight can ingest it. Log Insight can also extend to additional infrastructure layers via content packs. Content packs for various storage arrays, servers, and network switches are available.

As of the 3.3 release, users with a supported vCenter Server license are permitted to a 25-OSI pack of vRealize Log Insight, free of charge.

Download vRealize Log Insight OVA from VMware.

Deploy Insight Log

First, we will deploy the OVA. To do so, right-click your cluster or host and select Deploy OVF Template.

**If you run into a Deploy OVF Template error during this step, check out this article.

Browse to the location of the OVA file.

Enter the name for the OVA and select the datacenter or folder for the deployment location.

Select the resource where you will run the deployed OVA.

Review the template details.

Read and Accept the EULA.

Select a size for deployment configuration. For our test, we will use Extra Small.

Extra Small: POC – Up to 20 ESXi hosts
- 2 CPU
- 4 GB Memory
- 132 of Storage
Small: Up to 200 ESXi hosts
- 4 CPU
- 8 GB Memory
- 510 GB of Storage
Medium: Up to 500 ESXi hosts
- 8 CPU
- 16 GB Memory
- 510 GB of Storage
Large: Up to 1,500 ESXi hosts
- 16 CPU
- 32 GB Memory
- 510 GB of Storage

Select the Location and Disk Format for your deployment. VMware recommends using Thick Eager-Zeroed disk format for performance. Since this is for testing, we will utilize thin provisioning.

Select the destination network and protocol.

Finally, customize the Network Properties. Set the Root Password and SSH Public key if desired.

Review your configuration and click Finished when ready.

You can monitor the deployment process in vCenter’s Recent Tasks.

After the deployment, power on the machine.

The bootstrap configuration will begin. Launch a remote console session to monitor the process. Once it has successfully booted, you will see this screen.

Configure Log Insight Application

We are now ready to configure vRealize Log Insight! Browse to the IP address that was set earlier. Click Next to begin.

As this is a new deployment, pick Start New Deployment.

Enter the E-mail and Password for the admin user.

Next, add your license key. If you are running vSphere 6.x, enter your vCenter Server License key. If you have bought a license, use that here.

As per mentioned earlier, users with a vCenter Server license are entitled to a 25-OSI pack of vRealize Log Insight for vCenter Server.

Configure settings for System Notifications.

Insight Configuration

Choose to synchronize time with NTP servers or the ESXi host.

Enter the SMTP settings for outgoing e-mail notifications.

The configuration is now complete! Click Finish.

Next, you will be able to setup Log Insight to ingest vSphere data. Click Configure vSphere Integration.

This will bring you to the vSphere Integration page. Enter the pertinent vCenter Server information and chose if you would like to bring in both vCenter Server events and ESXi host logs. When finished, click Save.