Recently v2.0 of VMware Log Insight became GA, and I’ve been playing around with it since it’s release. Having been on the BETA of the 1.5 Version the 2.0 Version is streets ahead in terms of usability and completeness. Living day in and day out within vCloud Director I decided to look at hooking up the vCloud Cell Logs to Log Insight and create a basic Dash Board to assist us in working through vCD logs.
First up you need to SSH into your vCloud Cell and head to:
|
1 |
/opt/vmware/vcloud-director/etc |
From there you want to edit the log4j.properties file. Probably worth making a backup of the file before the edit. Go to the bottom of the file and append the following, making sure to substitute the xxx.xxx.xxx.xxx on the second line below with the IP or hostname of your Log Insight Server.
|
1 2 3 4 5 6 7 8 |
log4j.appender.vcloud.system.syslog=org.apache.log4j.net.SyslogAppender log4j.appender.vcloud.system.syslog.syslogHost=xxx.xxx.xxx.xxx #Logs go to port 514 unless you specify a port, as in the disable example below. #log4j.appender.vcloud.system.syslog.syslogHost=remoteSyslogHost.example.com:5555 log4j.appender.vcloud.system.syslog.facility=LOCAL1 log4j.appender.vcloud.system.syslog.layout=com.vmware.vcloud.logging.CustomPatternLayout log4j.appender.vcloud.system.syslog.layout.ConversionPattern=%d{ISO8601} | %-8.8p | %-25.50t | %-30.50c{1} | %m | %x%n log4j.appender.vcloud.system.syslog.threshold=INFO |
You can see that we can control the level of logging being sent through to Log Insight by editing that last line and changing the threshold to WARN or CRITICAL. Once that section has been added, head back to the top of the file and modify line 2 as shown below
|
1 2 3 |
# Root logger #log4j.rootLogger=ERROR, vcloud.system.debug, vcloud.system.info log4j.rootLogger=ERROR, vcloud.system.debug, vcloud.system.info, vcloud.system.syslog |
What we are doing there is adding the source we just configured in the first step. Save the file and restart the vmware-vcd service
|
1 2 3 |
service vmware-vcd restart Stopping vmware-vcd-watchdog: [ OK ] Stopping vmware-vcd-cell: [ OK ] |
Load up the Log Insight Web GUI and go to the Interactive Analytics Page. If you hit search a couple of times you should start seeing vCloud Director related entries appear in the Events pane.
Click on the Add Filter Icon and sort by Source -> Contains and Enter in the host name of the vCloud Cell. Depending on the amount of hosts you are logging the Cell may appear in the list as you click into the search box. Hit the Search button and you will see your filtered log entries in the events pane. To make for easier reading, I choose the Field Tab which makes reading the entries a little easier.
Finally we can create a basic Custom Dashboard to view cell log numbers over time. With the above Filter in play, click on the Add to Dashboard icon which is on the right hand side of the search button and give a name relating to the Cell. In the example below I already have a Dashboard created so it appears in the drop down list…otherwise you can create a new one from this window.
After clicking on Add you can go back to the Log Insight Dash Boards to view your creation.
Again, its a very basic display literally showing you the number of events in a period of time, however the usefulness here is that if you have to search for an event you can drill down and perform an Interactive Analysis with a little more accuracy.
Watch out for more Content Packs to Come out for Log Insight…the library will only grow and give more value add to this tool.
