What's new in log insight 3.3 presentation

© 2014 VMware Inc. All rights reserved.

What’s New in VMware® vRealize™ Log Insight™ 3.3

Bill RothProduct Marketing Manager

Karl FultzTechnical Marketing Manager

05/01/2023

2

Automation

Service CatalogGovernance

Release Automation

Operations

Service HealthCapacity Optimization

Configuration Standards

IT Business

Cost TransparencyBenchmarkingService Quality

VMware Cloud Management

Compute

Physical Hardware

Private Clouds

Public Clouds

Hybrid CloudVMware &

vCloud Datacenter Partners

Virtualized InfrastructureAbstract & Pool

Compute Abstraction = Server Virtualization

Storage

Storage Abstraction = Software-Defined

Storage

Network

Network Abstraction = Virtual Networking

Applications Modern SaaSTraditional

The Control Plane for the Software-Defined Data Center and the Hybrid Cloud

Today’s Reality in Operations Management

3

Monitoring Data Overload Alert Storms

Finger Pointing

DBA

VI Storage

Over-provisioning

Silo-ed Operations Management with no single solution

Downtime and Performance Degradation

• Unified operations solution across virtual, physical, storage, network and apps

• Quality of service

• Guided remediation with accelerated root cause analysis

Key Challenges For Customers

Cost Cutting and Reduced Budgets

1

2

3

• Optimal utilization of existing IT assets

• Greater operational efficiency

What do Customers Need?

5

What Could You Do If You Had Insight?

Solve problems faster— from days to hoursvRealize™

Log Insight™

Find problems you didn’t know you had

Get actionable insight into what it means

Logs as Last Mile to Root Cause Analysis

6

SCSI ErrorsNFS Errors

vMotion FailuresHost DisconnectsDropped Packets

Failed TasksSlow Host SyncsSlow DB Queries

vRealize Log Insight 3.3

• Log Insight for vCenter Edition

• Integrated Load Balancer Capabilities• Multiple VIPs with Associated Tags

• Enhanced vSphere Integration

• Alert Option – Webhooks

• UI Enhancements• View Chart Data as Table

• Authentication and Simple Query APIs

• LTSV, Regex, and Syslog Agent Parsers

• IPv6 Support

• Additional Features• Log Importer• Agent Configuration – Preview

vRealize Log Insight 3.3

What’s New

vRealize Log Insight for vCenter

vRealize Log InsightAvailable with vCenter Server Standard

Intelligent Log Analytics for vCenter• Free 25-OSI Log Insight pack per vCenter Benefits of vRealize Log Insight for vCenter• Powerful big data log management built for vSphere• Includes all VMware Content Packs • Extensive Log Management – Captures log data from

physical servers, network and storage devices, OSs, applications, and more

• Intuitive on-the-fly keyword filtering and custom dashboards

• Integration with vRealize Operations – Inventory integration, 2-way Alert Visualization

NEW

The best real-time management for SDDC

Security

App

Operating System

vSphere

System Statistics

Applications Other IT

App

Logs

Upgrade to Full vRealize Log Insight for:

• Extensibility – 3rd Party and Custom Content Packs such as Microsoft, Cisco, EMC, NetApp (29+ available)

• Scalability – Cluster Support and Event Forwarding• High availability, Archiving and SSL

Integrated Load Balancer – Multiple VIP

10

Define multiple VIPs

with ILBAssociate tags with each VIP. Useful for RBAC and Content

Packs

ILB Election process is unchanged

vSphere Integration Enhancements

11

Add tags for vCenter and ESXi events. RBAC use case

Automatically add unconfigured

Hosts

Choose ILB VIP

Alert Enhancement - Webhooks

12

Send alerts using HTTP

POST

Point to external URLs, i.e. vRO,

SocialCast, ServiceNow

13

View Chart Data as a Table

Build data visualizations using a table

Choose Table to change the visualization•  

14

Authentication API• Use-case: Required to leverage the query API (discussed next)

Request ResponseGET /api/v1/sessions HTTP/1.1Host: localhost:9543Accept: application/json

HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8 {  "userId": ”<user_guid>",  "ttl": <int>}

POST /api/v1/sessions HTTP/1.1Host: localhost:9543Accept: application/jsonContent-Type: application/json { ”provider”: “<Local|ActiveDirectory>”,  "username": ”<username>",  "password": ”<password>"}

HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8 {  "userId": ”<user_guid>",  "sessionId": ”<session_id>",  "ttl": <int>}

15

Simple Query API• Use-case: Used to programmatically query for data in Log Insight

Request ResponseGET /api/v1/events/timestamp/%3E10 HTTP/1.1Host: localhost:9543Accept: application/jsonAuthorization: Bearer <session_id>

HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8 { "complete": true, "events": [ { "fields": [ { "content": "172.16.127.1", "name": "hostname" }, { "content": "v4_e0cb4506", "name": "event_type" }, { "content": "172.16.127.1", "name": "source" } ], "text": "this is a test event", "timestamp": 1449771888082 } ] }

GET /api/v1/aggregated-events/<value> HTTP/1.1Host: localhost:9543Accept: application/jsonContent-Type: application/jsonAuthorization: Bearer <session_id> 

HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8 { "complete": true, "events": [ { …

16

New Client-Side Agent Parsers

• Labeled Tab-Separated Values (LTSV) format is a variant of Tab-Separated Values (TSV)

• Syslog parser automatically parses timestamp from the beginning of the log and extracts application name as filed with name "appname".

• Regex based on boost::regex 

LTSV Syslog Regex

[filelog|simple_logs]directory=/var/loginclude=*parser=ltsv

[filelog|simple_logs]directory=/var/loginclude=*parser=syslog

[filelog|simple_logs]directory=/var/loginclude=*parser=regex_parser

[parser|regex_parser]base_parser=regexformat=(?<tag1>\d{4})[-](?<tag2>\d{4})[-](?<tag3>\d{4})

Additional Features• Copytruncate Support

– Creates a copy of a log file then truncates the original log file.

• Additional OVF options– DNS searchpath and DNS domain– Allows hostname only name resolution.

• New Importer Utility – Windows or Linux command-line tool used for importing offline or archived

logs to the Log Insight server.

• Agent support for Windows 10• Hybrid License• Agent Configuration Builder (Tech Preview)

– Streamlines the build and validation of agent configurations.

• Virtual Appliance IPv6 support (Tech Preview)

Learn More

Try the Hands-on Lab. Nothing to download!

20

Visit the website for resources, 60-day free trial,

evaluation guide, and purchasing information.

@VMLogInsight

www.vmware.com/products/vrealize-log-insight

vmware.com/go/vRealize-Ops-Insight-HOL

loginsight.vmware.com/

Website:

Hands-on Lab:

Log Insight Community:

Thank You

Questions? Email broth@vmware.com