vRealize Log Insight – vRA 7 content pack configuration

A couple of months ago Kimberly Delgado wrote a detailed blog on the new vRA 7 content pack for vRealize log insight which includes all the enhancements. No need to me to repeat and link provide below.


I have had these steps written down quite some time ago but never really got around to putting into a blog, but since my post a couple of days ago on how to setup vRO content pack I though this would be fitting since these 2 content packs really go hand in hand.

vRA consists of multiple components and therefore can be configured with a simple or enterprise installation. This makes the deployment of the vRealize log insight agents interesting since you have install and/or configure the agents on both Windows (IaaS) and linux (virtual appliances).

The vRA content packs makes use of the Log Insight agent for both Windows and Linux which is great since this simplifies the configuration a lot!  The agent already comes preinstalled on vRA virtual appliances (easy) but still needs to be installed on the other component servers.

My configuration is an enterprise installation with following servers.

  • 2 x vRA virtual appliances
  • 2 x IaaS management
  • 2 x IaaS web
  • 2 x DEM/Agent servers

Here are the steps:

  • Login to vRealize Log insight
  • Select Content Packs
  • Select Marketplace
  • Select VMware – vRA 7 and install.
  • Select Administration
  • Under management select Agents.
  • Verify the agent groups “vRealize Automation 7 – Linux” and “vRealize Automation 7 – Windows” are available from drop down box.
  • Scroll to the bottom of Agent page and select “Download Log Insight Agent Version 3.x.x”
    • Download the Windows MSI.  Remember no need to download the linux agent since the agent is already preinstalled on vRA appliance.
  • Install windows agents on all IaaS web servers.
    • Run the msi on windows server.
    • Enter/verify the hostname of vRealize log insight <loginsightname.domain.com> during configuration setup.  Since we downloaded the agent from the vRLI server management UI the hostname gets populated in installer. cool!
    • Press Install
  • SSH to the vRA VA and update liagent.ini to point to the LI server.
    • Update the log insight file /var/lib/loginsight-agent/liagent.ini
      • Update hostname=<vrealizeLogInsightserver.domain.com>
      • Some additional parameters are available for configuration like protocol, port, ssl and reconnect.
  • Login to vRealize log insight to verify the agents are communicating with vRI server.
    • Select Administration
    • Select Agents
    • Verify agents are showing up in list.  If they do not verify that the service is running on the server or review the log files for agent on windows servers C:\ProgramData\VMware\Log Insight Agent\log
  • Now lets create the new agents groups
    • Highlight each of agent groups mentioned earlier from the drop down box and select copy template.(double square icon on far right)
    • Create filters to limit to the required servers.  Since we have 6 IaaS windows servers I create a easy filter with hostname starts with vraweb,vradem,vramgr.  Click refresh and you should now see all 6 agents.
    • Some further configuration is required here and we need to update and/or add to the agent configuration file logs for Windows agents.
      • Have a look at Vra-dem, vra-dem-metrics, vra-deo, vra-deo2
      • For instance lets review vra-deo where the directory is normally <hostname>-DEO after Distributed Execution Manager folder.
      • By default the directory is set to “C:\Program Files (x86)\VMware\vCAC\Distributed Execution Manager\DEO\Logs\”. This is incorrect…
      • Screen Shot 2016-10-05 at 5.56.13 PM.png
      • Directory SHOULD BE C:\Program Files (x86)\VMware\vCAC\Distributed Execution Manager\FQDN-DEO\Logs\
      • screen-shot-2016-10-05-at-5-57-12-pm
      • Also in my case I have multiple DEM and management servers so we have to create additional file log entries for each of the servers since the DEM folder name changes.
      • The easiest method to duplicate File Logs is to select the Edit tab and copy/paste original filelog and then just update the directory.
        • Screen Shot 2016-10-07 at 10.04.54 AM.png
      • The other method is to hover over File Logs and you will see a green “+ New” button appear, select it.  Lets called it “vra-dem2” to add the 2nd server file location.
        • I hope they release a feature to clone the file logs but currently I just go back and forth between original and new file log and copy paste the items since only change required is the directory, rest of entries stay the same.
        • Add the same tags manually
        • Do not forget to update the parse fields from drop down box as well.
        • screen-shot-2016-10-05-at-6-16-15-pm
      • Select “Save Agent Group”
      • This can be confusing and a bit tricky but I hope my explanation makes sense to update the file logs for Agent Configuration build.

Complimentary content packs which are highly recommend:

  • VMware Orchestrator 7.0
  • VMware vSphere
  • VMware NSX-vSphere (if implemented)

You should start seeing the event count increase for each of the agents as well as dashboards populating.  Go geek out on stats!  But wait, the Catalog dashboard also provides you with valuable pre-build queries to perform analysis on specific errors and failure scenarios.  The queries are different per dashboard so I do encourage you to get familiar with each.  Example of Alert Queries below for General – Problems dashboard:

Screen Shot 2016-10-07 at 6.40.14 PM.png




Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s