HOL-SDC-1431

My Company © 2010

HOL-SDC-1431 1
 Table of Contents
Lab Overview - HOL-SDC-1431 - vSphere Optimization Assessment ............. 8
Lab Guidance ................................................................................................. 8
Integration with vCenter Operations .................................................................................... 10
Module 1 - VMware Optimization Assessment (15 Min) ............................... 11
Introduction to VMware Optimization Assessment ............................................ 11
VMware vSphere Optimization Assessment Program Overview ........................................... 11
vSphere Optimization Assessment Resources ..................................................................... 13
Importing VOA Reports into vRealize Operations Manager ............................... 15
Launch Firefox .................................................................................................................... 15
Login to vRealize Operations Manager ................................................................................ 16
Content .............................................................................................................................. 16
Solutions............................................................................................................................. 17
Add Solution ....................................................................................................................... 17
Select reports .pak file ........................................................................................................ 18
Set Override options and Upload ........................................................................................ 19
Complete Upload................................................................................................................ 20
Read and Accept EULA ....................................................................................................... 21
Finish the Report Installation ............................................................................................... 22
Navigate to the new reports ................................................................................................ 23
Complete! ........................................................................................................................... 23
Running the vOA Reports ............................................................................... 24
Select the report you would like to run ................................................................................ 24
Select an Object ................................................................................................................. 25
Access Generated Reports ................................................................................................. 26
Export the report ................................................................................................................. 26
Open File............................................................................................................................ 27
View Report ........................................................................................................................ 28
Custom Views (optional) ...................................................................................................... 29
Access Sample Reports .................................................................................. 30
Return to the Desktop ......................................................................................................... 30
Open Sample VOA Reports ................................................................................................ 30
Sample reports ................................................................................................................... 31
Open the Consolidation Assessment Report ....................................................................... 32
Capacity Assessment Guidance .......................................................................................... 33
Reclaimable Capacity .......................................................................................................... 34

HOL-SDC-1431 2
 Host Rightsizing .................................................................................................................. 35
Powered Off VMs ................................................................................................................ 36
Host Density and Capacity .................................................................................................. 36
Capacity Options ................................................................................................................ 37
Performance Assessment Guidance .................................................................................... 38
Host Performance ............................................................................................................... 39
Problem Alerts .................................................................................................................... 39
VM Performance ................................................................................................................. 40
Host Demand\Usage .......................................................................................................... 41
Configuration Assessment .................................................................................................. 42
Cluster Configuration Summary ........................................................................................... 43
Host Hardware Summary .................................................................................................... 43
Host ESX Version ............................................................................................................... 44
Hosts in Maintenance Mode ................................................................................................ 45
SSH Enabled Hosts ............................................................................................................. 46
NTP Service Status ............................................................................................................. 47
Virtual Machine Hardware Summary .................................................................................... 48
Virtual Machine OS Distribution ........................................................................................... 49
Virtual Machine Power State ............................................................................................... 50
Virtual Machine Configured Memory ................................................................................... 51
Virtual Machine vCPU Distribution ....................................................................................... 52
VMware Tools..................................................................................................................... 53
VMware Tools Version ........................................................................................................ 54
VMware Tools Status .......................................................................................................... 55
Conclusion ......................................................................................................................... 55
Module 2 - Getting started with Log Insight (30 Min) ................................. 56
Setting up Log Insight .................................................................................... 56
Open the README File ....................................................................................................... 56
Launch Firefox .................................................................................................................... 57
Connect to the loginsight-01a appliance .............................................................................. 57
Setup .................................................................................................................................. 58
Admin Credentials .............................................................................................................. 58
License ............................................................................................................................... 59
License Key ........................................................................................................................ 59
General Configuration ......................................................................................................... 60
Time Configuration ............................................................................................................. 61
SMTP Configuration ............................................................................................................ 62
SMTP Configuration - Save and Continue ............................................................................ 63
Setup Complete .................................................................................................................. 64
Ready to Ingest Data........................................................................................................... 65
Configuring vCenter & vSphere Integration ..................................................... 66

HOL-SDC-1431 3
 Configuring vCenter & vSphere Integration ......................................................................... 66
Test successful ................................................................................................................... 67
Wait for vCenter and ESXi Host configuration to complete ................................................... 67
Configuration completed successfully ................................................................................. 68
Look at Help Information ..................................................................................................... 68
Which vCenter Logs? .......................................................................................................... 68
Launching WinSCP .............................................................................................................. 69
Logging into vCSA .............................................................................................................. 70
Authentication Banner......................................................................................................... 71
Copying the File.................................................................................................................. 72
Logging into vCSA with Putty .............................................................................................. 73
Log into vCSA with Putty ..................................................................................................... 74
Preparing the Script ............................................................................................................ 75
Running the Script............................................................................................................... 76
vCenter Log Collection Complete ....................................................................................... 77
Cleaning Up ........................................................................................................................ 77
Installing & Managing W indows Agents ........................................................... 78
Create a DNS Alias for LOGINSIGHT ................................................................................... 79
Edit the corp.local Forward Lookup Zone ............................................................................ 80
New Alias (CNAME) ............................................................................................................. 81
New Resource Record ........................................................................................................ 82
Test DNS Alias .................................................................................................................... 82
Clear DNS........................................................................................................................... 83
Ping LOGINSIGHT ............................................................................................................... 83
Close Windows DNS Manager ............................................................................................ 84
Switch back to Loginsight-01a ............................................................................................. 85
Select the Agents Management Page ................................................................................. 85
Agents ................................................................................................................................ 86
Download Log Insight Agent Version 2.5.0 .......................................................................... 87
Save file.............................................................................................................................. 87
Launch the Log Insight Agent Installer ................................................................................. 88
VMware vCenter Log Insight Agent Setup - EULA ................................................................ 89
VMware vCenter Log Insight Agent Setup - Server Configuration ........................................ 90
VMware vCenter Log Insight Agent Setup - Finish ............................................................... 91
Close the Download Agents Selection Box ......................................................................... 91
Refresh the Agents information page .................................................................................. 92
Configuring the Log Insight Windows Agent after Installation ............................................... 92
Open the Log Insight agent .ini file ...................................................................................... 93
Add a Windows Events Channel .......................................................................................... 94
Save and exit Notepad ....................................................................................................... 95
Centralized Windows Agent Configuration .......................................................................... 96

HOL-SDC-1431 4
 Installing and Managing Linux Agents (New in v2.5) ......................................... 97
Launch the vSphere Web Client .......................................................................................... 97
Login to the vSphere Web Client ......................................................................................... 98
Launch vCenter .................................................................................................................. 98
VMs and Templates ............................................................................................................ 99
Ensure that Sles-01a is Powered On ...................................................................................100
Log into Sles-01a ................................................................................................................101
Log into Sles-01a ................................................................................................................102
Open root's Home Directory ..............................................................................................102
Open the Documents folder ...............................................................................................103
Observe the different versions of the Linux agent ...............................................................103
Install the Log Insight Linux agent .......................................................................................104
Local file installer is running as a privileged user ................................................................104
Do you want to install this file ?...........................................................................................105
Authenticate ......................................................................................................................105
File was installed successfully ............................................................................................106
Confirm that the Log Insight agent has been installed .........................................................106
Go To: /var/lib/loginsight-agent/ .........................................................................................107
loginsight-agent - File Browser ...........................................................................................107
Switch Over to loginsight-01a browser tab ..........................................................................108
Refresh the Agents information page .................................................................................108
Switch back over to the Sles-01a console tab .....................................................................109
Open the liagent.ini file ......................................................................................................109
liagent.ini settings ..............................................................................................................110
liagent.ini settings (cont.) ....................................................................................................111
liagent.ini settings (cont.) ....................................................................................................112
Close liagent.ini .................................................................................................................113
Open liagent-effective.ini ...................................................................................................113
Observe the effective configuration of the Log Insight agent ..............................................114
Close liagent-effective.ini ...................................................................................................115
Navigate to GNOME Terminal ............................................................................................116
Launch GNOME Terminal ...................................................................................................116
Check the status of the Log Insight Agent service ..............................................................117
Test Linux Logging.............................................................................................................117
Restart the Log Insight Agent Service .................................................................................118
Switch Over to loginsight-01a browser tab ..........................................................................118
Select Interactive Analytics.................................................................................................119
Filter for logs from full-sles-01a (The full name of Sles-01a) ..................................................119
Configuring Active Directory Integration ........................................................ 121
Enabling Active Directory Integration ..................................................................................121
Configuration -> Authentication ..........................................................................................122

HOL-SDC-1431 5
 Authentication Configuration ..............................................................................................123
Adding Active Directory Users and Groups to Log Insight ...................................................124
Add an Active Directory User to Log Insight .......................................................................125
New User ..........................................................................................................................125
Add an Active Directory Group to Log Insight .....................................................................126
New Group ........................................................................................................................127
Installing Content Packs ............................................................................... 128
Managing Content Packs ...................................................................................................128
Log Insight Content Pack Marketplace ...............................................................................129
Log Insight Content Pack Marketplace ...............................................................................130
VMware - vSphere Content Pack ........................................................................................131
Log Insight General Content Pack ......................................................................................131
Import the vCenter Operations Manager Content Pack .......................................................132
Import Content Pack ..........................................................................................................133
File Upload ........................................................................................................................134
Import Content Pack ..........................................................................................................135
Import to My Content .........................................................................................................136
My Content ........................................................................................................................137
Success - VMware - vCenter Operations Manager Content Pack Installed to My Content ....138
Import the vCloud Automation Center Content Pack ...........................................................139
Import Content Pack ..........................................................................................................139
File Upload ........................................................................................................................140
Import Content Pack ..........................................................................................................141
Succes - VMware - vCloud Automation Center 6.0 Content Pack Installed .........................141
Import the NSX Content Pack .............................................................................................142
Import Content Pack ..........................................................................................................142
File Upload ........................................................................................................................143
Import Content Pack ..........................................................................................................144
Success - VMware - NSX-vSphere Content Pack Installed ..................................................144

HOL-SDC-1431 6
HOL-SDC-1431 7
Lab Overview - HOL-SDC-1431
- vSphere Optimization
Assessment
Lab Guidance
This Lab, HOL-SDC-1431 covers the vSphere Optimization Assessment (vOA) Reports
and Getting Started with Log Insight. You do not need to perform both modules or go
through them in any particular order. You will have 90 minutes per lab session. For your
convenience, please note the approximate times it takes to do each module so that you
may plan accordingly.

Module 1 - VMware Optimization Assessment Reports (15 minutes)

 Importing the vOA Reports

 Explore the reports and views

 Running the reports

 Accessing sample reports

Module 2 - Getting Started with Log Insight (30 minutes)

 Setting up the Log Insight Appliance

 Configuring vCenter & vSphere Integration

 Configuring vCenter Operations Manager Integration

 Installing and Managing Windows Agents

 Configuring and Managing Linux Agents (New in v2.5)

 Configuring Active Directory Integration

 Installing and Exploring Content Packs

HOL-SDC-1431 8
Note: The next few pages of the lab manual are meant to provide an overview of the
integration of vRealize Operations Manager (vR Ops) with Log Insight. The combination of
vR Ops and Log Insight can be extremely powerful for last-mile root cause analytics. For
additional Labs on this topic see HOL-SDC-1424. Additional material can also be found
at http://www.vmware.com/products/vrealize-operations-insight. Jump ahead if you
would rather get right to the interactive portion of the lab.

Integration with vCenter Operations Management

Integration of Log Insight with the vCenter Operations platform extends operational
visibility and proactive management capabilities across infrastructure and applications in a
dynamic, hybrid cloud environment.

Integration also helps you maximize ROI and value by bringing unstructured data (such as
log files) together with structured data (such as metrics and key performance indicators),
offering a significantly enhanced solution for end-to-end operations management.
Developed by VMware experts, Log Insight comes with built-in knowledge and native
support for VMware vSphere® with Operations Management™. It is the solution best suited
for your VMware environment. With Log Insight you can analyze logs beyond your virtual
infrastructure and use a central log management solution to analyze data from your entire
IT environment, including your physical infrastructure, operating systems, applications,
network and storage devices.

HOL-SDC-1431 9
Integration with vCenter Operations

Integration of Log Insight with the vCenter Operations platform extends operational
visibility and proactive management capabilities across infrastructure and applications in a
dynamic, hybrid cloud environment.

HOL-SDC-1431 10
Integration also helps you maximize ROI and value by bringing unstructured data (such as
log files) together with structured data (such as metrics and key performance indicators),
offering a significantly enhanced solution for end-to-end operations management.

Lab Captains: Bill Amirault, Kyle Geisler, Al Grandville

Module 1 - VMware
Optimization Assessment (15
Min)
Introduction to VMware Optimization
Assessment
VMware vSphere Optimization Assessment Program Overview

HOL-SDC-1431 11
The vOA Reports were designed to allow you to produce impactful results in 3 phases
over the course of a 30-day evaluation period. Due to the design of the analytics, certain
performance and capacity data needs be collected for longer periods of time. For this
reason we've broken vOA into 3 phases, with a report for each phase and a consolidated
report that combines them.

The reports are as follows:

 The first report is focused on Configuration and provides immediate results on Day 1 of
the vOA.

 The second report is focused on Performance and provides accurate results after
about Day 7.

 The third report is focused on Capacity and provides accurate results after about Day
21.

 The final report is consolidation of the first 3 and re-orders the data. It can be run
anytime after day 21.

HOL-SDC-1431 12
vSphere Optimization Assessment Resources

VMware Partners can find out more information on performing the VOA here -
http://www.vmware.com/go/vsphereoptimization. Note that you will need to login to
Partner Central in order to access this link.

Also, the URL for external access to VOA's is (coming soon) :

http://www.vmware.com/assessment/voa.

HOL-SDC-1431 13
This site includes all the resources you need for the vSphere Optimization Assessment
including:

 Sales Campaigns

 How to download and install an evaluation of vRealize Operations, including these

product generated reports, training videos, etc.

 How to present the findings to your customer with included Word and Powerpoint
Templates.

If you are a VMware Customer and are interested in the VMware Optimization
Assessment, please contact your VMware Partner for more information.

HOL-SDC-1431 14
Importing VOA Reports into vRealize
Operations Manager
Four (4) new reports were created for the VOA program and are available on the partner
VOA site or as part of the VOA registration process. We will begin by walking through the
process of importing them into vRealize Operations (vR Ops) Manager using the Solutions
Add feature.
We will run each of these reports against a set of resources. Because vR Ops analytics
learns as it collects, the lab does not have fully populated report results. We've included
report results from an actual environment, which are located on the desktop under the
folder called "Sample VOA Reports".

Launch Firefox

The Homepage is set to vR Ops 6.0

HOL-SDC-1431 15
Login to vRealize Operations Manager

User name: admin

Password: VMware1!

Click Login

Content

In the left hand navigation pane, click Administration

HOL-SDC-1431 16
Solutions

You will automatically land on the Solutions tab

Add Solution

Select the green plus icon to add a Solution

HOL-SDC-1431 17
Select reports .pak file

Select Browse a solution

Browse to Desktop/ VOA Reports folder and select the VOA_Reports-FINAL-

v2.pak file and choose Open

HOL-SDC-1431 18
Set Override options and Upload

Select the checkbox for Force Installation AND Reset out-of-the-box content...

Note: You will not need to select these options in a clean environment unless you've
previously attempted to install the VOA reports.

Select Upload

Note: If you accidentally select Upload first and receive an error, simply start over with the
last step of browsing to the .pak file again.

HOL-SDC-1431 19
Complete Upload

You should see the message that the .pak file is ready to install.

Select Next

HOL-SDC-1431 20
Read and Accept EULA

Check the EULA acceptance box

Select Next

HOL-SDC-1431 21
Finish the Report Installation

Select Finish

HOL-SDC-1431 22
Navigate to the new reports

Select the Content shortcut icon

Click on Reports

You will now see the 4 VOA Reports, with VOA in brackets.

Leave this window as is for the next section.

Complete!
You are now finished with this section of the module. Continue to the Running Reports
section.

HOL-SDC-1431 23
Running the vOA Reports
You can choose to run the reports in any order you would like, or just run the
Consolidated Report, which is all 3 of them combined. The phases are there for real-world
guidance to ensure your are viewing accurate data and seeing value from the evaluation
from Day 1.

Select the report you would like to run

While still in the Reports section of the UI, select the report you would like to run.

Select the icon with the play image

HOL-SDC-1431 24
Select an Object

Select desired Object level. For this lab you can simply choose vSphere World or
either of the next 2 levels.

Select OK

HOL-SDC-1431 25
Access Generated Reports

Click on the Generate Reports tab (1). Here you will see the report is Processing.

You can click the refresh button (2) until the report status is marked as Complete.

Export the report

Once the Status changes to Completed, select whichever format (PDF or CSV) you desire
by simply clicking on the icon.

Note: For more realistic results proceed to the next section on Sample Reports

HOL-SDC-1431 26
Open File

Open the PDF with Adobe Reader

HOL-SDC-1431 27
View Report

Browse the contents of the report.

Repeat as desired.

Note: For more realistic results proceed to the next section on Sample Reports

HOL-SDC-1431 28
Custom Views (optional)

If you would like to see the Views that were created for VOA, select the Views tab

Type in VOA as a filter

Modify any of them to see how they are configured and how the filters were used to
eliminate unwanted results.

That completes this section of the module.

HOL-SDC-1431 29
Access Sample Reports
In this section we will cover how to access the VOA Sample Reports
When running the VOA beta reports against this Hands on Lab environment, due to the
way vR Ops analytics work, we will not have complete results. Therefore, we’ve included
report results from a larger environment that has been up and running longer. Feel free to
browse the results to get a better feel for the value that these reports provide in a more
realistic environment.

Return to the Desktop

Minimize any open windows and locate the Sample VOA Reports folder on the
desktop.

Open Sample VOA Reports

HOL-SDC-1431 30
Open the folder and open the desired sample PDF reports.

Sample reports

As a refresher, here is a bit more detail on each report:

 VOA Consolidated Assessment.pdf - The Consolidated Assessment Report is run ~ 21

days after the initial VOA install. It is a consolidated report of the next three reports,
Configuration Reporting, Performance Reporting and Capacity Reporting. Since this
report includes all three reports in one PDF, we will be reviewing this in the remainder
of the lesson.

 VOA Phase 1 Configuration Report.pdf - The Configuration Reporting report is run day 1
of the VOA install. This report can help show value on day one by showing how an
environment's resources are configured.

 VOA Phase 2 Performance Report.pdf - The Performance Reporting report is run on or

around day 7 of the assessment. This report provides details on potential performance
issues in the enviornment.

 VOA Phase 3 Capacity Report.pdf - The Capacity Reporting report run on or around
day 21 of the assessment and is the typically the time when accurate Capacity results
are available. This report will help identify if the environment's capacity is being
optimally used.

HOL-SDC-1431 31
Open the Consolidation Assessment Report

Open the PDF titled 'VOA Consolidation Assessment Report' by double clicking it.

Again, this report is run after 21 days. It consolidates the Configuration Report,
Performance Report and Capacity Report into one PDF. Since this report has the
information from all of these reports, we'll focus just on the Consolidated Assessment
Report.

HOL-SDC-1431 32
Capacity Assessment Guidance

In the first few pages of the PDF, you find an overview on the vSphere Optimization
Assessment and the report itself.

Next, you will see some guidance on the Capacity Assessment.

This report will help identify how the Capacity in the environment is being used. By
checking for Powered Off or Idle VMs and how Snapshots are being used, you can help
identify resources like CPU, Memory Network, and Disk that may be wasted. These
resources could be reallocated to provision new workloads.

HOL-SDC-1431 33
Reclaimable Capacity

As you scroll down you will see a graph and detailed list view reporting on Idle and
Oversized VMs,

Scroll to Page 8 in the PDF to see the detailed report on resources that are being wasted
by sitting idle or that are oversized.

When you run this report (Configuration Report) on Day 1, you can show immediate value
by revealing VMs that may not have been know about in the environment and are taking
up valuable resources.

HOL-SDC-1431 34
Host Rightsizing

On Page 10, you will see a list of hosts and see how they are being utilized. This may
show areas where clusters can be consolidated to better utilize host resources.

HOL-SDC-1431 35
Powered Off VMs

On Pages 11 and 12, you will see VMs that have been powered off and could be holding on
to capacity due to reservations.

Host Density and Capacity

If you continue to scroll down to Page 13, you will see what Host Density and Capacity look
like for your environment.

These reports can help identify an hosts that have less than 90 days worth of resources
available (This can be adjusted by the View filters). Consider using this report with the

HOL-SDC-1431 36
Reclaimable Capacity report to help identify where their are opportunities to reclaim and
reallocate resources to the hosts that need them the most.

You will then see the information presented at a Cluster level. You can use the same
methodology to assist you in reclaiming resources.

Capacity Options

Finally, on page 14 and 15, you will see the Capacity at the vCenter level. This view will
help you see what capacity you are at and if there may opportunities to utilize solutions
like Virtual SAN or vCloud Air move workloads to.

HOL-SDC-1431 37
Performance Assessment Guidance

As you continue scrolling down you will see guidance on the Performance
Assessment. This report will help identify Performance issues in the environment by
looking for:

 Patterns of high workload, which may be an indication of consuming too many

resources.

 Revealing Problem Alerts that have surfaced under Health and recommendations on
how to correct, if available.

 Show VM's with a > 20% of CPU Ready state, which could indicate contention between
VMs.

 Looking at Host Density scores for potential opportunities to consolidate VMs.

HOL-SDC-1431 38
Host Performance

On the next page you would typically see Hosts with Workloads greater than 50%
indicating that the VM's may not be evenly distributed. In this environment you will notice
there are no hosts with greater than 50% workload.

Problem Alerts

HOL-SDC-1431 39
You will then see current Problem alerts that have surfaced from Health. This section will
help identify resources the VMs are using or hardware in the Host that may be affecting
overall Performance. You can see for each entry, assistance on how to resolve each
problem is shown.

VM Performance

After some guidance about how vRealize Log Insight can help further root-cause analysis,
you will see some of the key performance indicators to look at when looking into VM
performance.

You may want to review the vSphere Performance Optimization lab, HOL-SDC-1404, for
more information on how to interpret these results or HOL-SDC-1426 for in-depth Log
Insight practice.

HOL-SDC-1431 40
Host Demand\Usage

The Host Demand\Usage detailed report shows the usage of the Hosts. Here you can
identify which hosts have being underutilized and could potentially be used to consolidate
workloads.

HOL-SDC-1431 41
Configuration Assessment

You will soon see the final section in the report, Configuration Assessment.

This report will show the Configuration of the environment and help you check for
inconsistencies and best practices by looking at the following:

 Cluster and Host setting around SSH, NTP and DPM.

 Verify the DRS, HA and Admission Control configuration.

 Verify that VM's have VM Tools installed and are at the most up to date version.

HOL-SDC-1431 42
Cluster Configuration Summary

Here you can quickly see which clusters have HA, Admission Control and DRS
enabled. The pages that follow will show this in graph form.

The forth chart will show which clusters have DPM (Distributed Power Management)
enabled.

Host Hardware Summary

HOL-SDC-1431 43
After the graphs, on Page 30, you will find a summary of the Hosts' Hardware. This can be
useful for checking CPU settings like Hyperthreading or Power management Policies.

Host ESX Version

This graph will show the versions (including build version) of ESX/ESXi hosts at the vCenter
level. This can be useful in finding host that may be out of date.

HOL-SDC-1431 44
Hosts in Maintenance Mode

The next graph shows vSphere hosts that are in Maintenance Mode. This will let you
quickly see if a host may have inadvertently been left in Maintenance Mode.

HOL-SDC-1431 45
SSH Enabled Hosts

The next two graphs will show if any hosts have SSH enabled and if the service is running.

HOL-SDC-1431 46
NTP Service Status

Here you can see what percentage of vSphere hosts have the NTP service running.

HOL-SDC-1431 47
Virtual Machine Hardware Summary

The Virtual Machine Hardware Summary report shows useful information about the VM,
like a summary of their configuration and if they are Thin Provisioned.

HOL-SDC-1431 48
Virtual Machine OS Distribution

If you scroll down to page 44, you will see how the OS is distributed between the VMs.

HOL-SDC-1431 49
Virtual Machine Power State

Next you will see the percentage of Virtual Machines that are powered on versus powered
off.

HOL-SDC-1431 50
Virtual Machine Configured Memory

This next graph show how the percentage of Virtual Machines using a specified memory
configurations. This can be useful in determining if Virtual Machines are using standard
configurations set by IT.

HOL-SDC-1431 51
Virtual Machine vCPU Distribution

This chart could also be used to see what Virtual Machines are not using standard IT
configurations related to vCPU configurations.

HOL-SDC-1431 52
VMware Tools

Here you can see the distribution of VMs that have VMware Tools installed and running.

HOL-SDC-1431 53
VMware Tools Version

Just as important as having VMware Tools installed, you will want to make sure you have
the most update tools installed or at least a supported version.

HOL-SDC-1431 54
VMware Tools Status

Finally, you are provided with the details on the Virtual Machines that are powered on, but
have out of date or unsupported VMware Tools installed.

Conclusion
This concludes this Module.

For VMware Partners, you can find out more information about the vSphere Optimization
Assessment at http://www.vmware.com/go/vsphereoptimization.

If you are a VMware Customer and are interested in the vSphere Optimization
Assessment, please contact your VMware Partner for more details.

HOL-SDC-1431 55
Module 2 - Getting started
with Log Insight (30 Min)
Setting up Log Insight
In this section we will go through the first setup and configuration of the Log Insight
appliance.

Open the README File

On the Controlcenter desktop double click on README.txt

HOL-SDC-1431 56
The README file contains all of the text that you will need to type during the lab. You
cannot cut and paste from the manual but you can from this file.

Launch Firefox

Double click on Firefox icon on the Controlcenter desktop

Connect to the loginsight-01a appliance

Click on the loginsight-01a tab

HOL-SDC-1431 57
Setup

Click Next

Admin Credentials

Username: admin

Email: administrator@rainpole.com

New password: VMware1!

HOL-SDC-1431 58
Confirm new password: VMware1!

Click Save and Continue

License

Type C40AQ-NG203-18A65-01902-ANE24 -or- Cut and paste from the README file
on the Controlcenter Desktop

Click Add License Key

License Key

Click Continue

HOL-SDC-1431 59
General Configuration

Email System Notifications To: administrator@rainpole.com

Click Save and Continue

HOL-SDC-1431 60
Time Configuration

NTP Servers: ntp.rainpole.com

Click Save and Continue

Note: Testing the time server is time consuming and often fails due to constraints in the
lab environment. Only click Test if you have time to kill and you enjoy being disappointed
:-)

HOL-SDC-1431 61
SMTP Configuration

SMTP Server: controlcenter.corp.local

Sender: loginsight-01a@rainpole.com

Username: loginsight@rainpole.com

Password: VMware1!

Test Email: administrator@rainpole.com

Click Send Test Email

HOL-SDC-1431 62
SMTP Configuration - Save and Continue

Click Save and Continue

HOL-SDC-1431 63
Setup Complete

Click Finish

HOL-SDC-1431 64
Ready to Ingest Data

The Log Insight appliance is now ready for us to configure log collection.

We can now move ahead to the vSphere integration section.

Click Configure vSphere Integration

HOL-SDC-1431 65
Configuring vCenter & vSphere Integration
Before you configure Log Insight to collect alarms, events, and tasks data from your
vSphere environment, you must connect Log Insight to one or more vCenter Server
systems.
Log Insight can collect two types of data from vCenter Server instances and the ESXi hosts
that they manage.
■ Events, tasks, and alerts are structured data with specific meaning. If configured,Log
Insight pulls events, tasks, and alerts from the registered vCenter Server instances.
■ Logs contain unstructured data that can be analyzed in Log Insight. ESXi hosts or
vCenter Server Appliance instances can push their logs to Log Insight through syslog.
In this lab section we will configure Log Insight to integrate with our vCenter and the two
hosts that it manages.

Configuring vCenter & vSphere Integration

Hostname: vcsa-01a.corp.local

Username: root

Password: VMware1!

Click Test Connection

HOL-SDC-1431 66
Test successful

Ensure you receive a Test successful message before continuing.

Note: If you do not receive a Test successful message check the vCenter server
information and try again.

Click Save

Wait for vCenter and ESXi Host configuration to complete

HOL-SDC-1431 67
Configuration completed successfully

Click OK

Look at Help Information

If you click the ? next to Collect vCenter Server events, tasks, and alarms, you will notice
that we need to configure vCenter to send its logs to Log Insight.

Which vCenter Logs?

HOL-SDC-1431 68
The vCenter Server appliance has multiple logs that we need to configure to send to Log
Insight. They are shown in the screenshot above. To make this easier, we are utilizing a
script from Virtually Ghetto Blogger William Lam. The entire article can be found
here: http://www.virtuallyghetto.com/2013/06/forwarding-logs-from-vcloud-suite-to.html

Launching WinSCP

The script is located on the ControlCenter Server and we need to move it to the
vCenter Server Appliance (vCSA).

1. Click on the Windows Start Button and type winscp

2. Double click on WinSCP

This will launch the WinSCP client which we will use to transfer the script to the vCSA.

HOL-SDC-1431 69
Logging into vCSA

1. Highlight vcsa-01a.corp.local.

2. Click Login. Click OK for the banner and you will be brought into the WinSCP UI.

HOL-SDC-1431 70
Authentication Banner

Click Continue

HOL-SDC-1431 71
Copying the File

Click the Home icon to navigate to C:\Users\Administrator\Documents in the left

Window pane.

Click the Home icon to navigate to /root in the right window pane.

Drag and drop configurevCloudSuiteSyslog.sh from the left pane to the right pane.

HOL-SDC-1431 72
Logging into vCSA with Putty

1. Click on the Windows Start Button

2. Click on Putty

HOL-SDC-1431 73
Log into vCSA with Putty

1. Click on vcsa-01a.corp.local

2. Click Open

HOL-SDC-1431 74
Preparing the Script

Login to the vCSA appliance

PuTTY should auto login as root.

In case it doesn't auto login, the credentials are:

user: root

password: VMware1!

Upon logging in, we are automatically placed in /root as shown above.

However, the script it not yet usable. We need to make sure we have permissions and the
ability to run this script.

Type chmod 777 configurevCloudSuiteSyslog.sh to make this script usable -or- cut
and paste from the README file

HOL-SDC-1431 75
Running the Script

If we type ./configurevCloudSuiteSyslog.sh we will be shown all the VMware

products that this script supports. Running this script on any of these products will redirect
their pertinent logs to the Log Insight.

To configure our vCenter to send logs to our Log Insight, type:

./configurevCloudSuiteSyslog.sh vcsa loginsight-01a

HOL-SDC-1431 76
vCenter Log Collection Complete

After running the above command, our vCenter is now sending logs to Log Insight.

Cleaning Up
You are now finished with this section of the module and may close WinSCP and PuTTY.

HOL-SDC-1431 77
Installing & Managing Windows Agents
The Log Insight Windows Agent collects events from Windows event channels and log
files, and forwards them to the Log Insight server.
A Windows event channel is a pool for collecting related events in a Windows system. By
default the Log Insight Windows Agent collects events from the Application, System, and
Security channels.
In a Windows system, applications can store log data in flat text files on the file system.
The Log Insight Windows Agent can monitor directories and collect events from flat text
log files.
The Log Insight Windows Agent has a limit of 64 KB per request to the Log Insight server.
The Log Insight Windows Agent runs as a Windows service and starts immediately after
installation. During and after installation, you can configure the following options for the
Log Insight Windows Agent:
■ Select the target Log Insight server to which the Log Insight Windows Agent
forwards events.
■ Select the communication protocol and port that the Log Insight Windows Agent
uses.
■ Add additional Windows event channels from which the Log Insight Windows Agent
collects events to.
■ Select Windows directories to monitor and add flat log files to collection.
In this lab section we will install the Windows Agent on the Controlcenter Server. In real
world deployments you could deliver the agent with your favorite application delivery
management methodology including vRealize Configuration Manager, Microsoft System
Center Configuration Manager, Active Directory GPO's, etc...

HOL-SDC-1431 78
Create a DNS Alias for LOGINSIGHT

The Log Insight Linux and Windows agents will, by default, look for a DNS entry called
"LOGINSIGHT". We can, of course, modify this behavior in the agents .ini file which we will
investigate later. For now, our intention is to streamline the agent deployment process with
the minimal amount of manual configuration so we will create a DNS alias that redirects
queries for LOGINSIGHT to loginsight-01a.corp.local.

HOL-SDC-1431 79
Click on the Windows icon on the Control Center Dekstop

Type 'dns' into the search box

Click on DNS to launch the Windows DNS Manager

Edit the corp.local Forward Lookup Zone

Double click on corp.local

HOL-SDC-1431 80
New Alias (CNAME)

Click on the Action menu

Click on New Alias (CNAME)...

HOL-SDC-1431 81
New Resource Record

Alias name: = LOGINSIGHT

Fully qualified domain name (FQDN): LOGINSIGHT.corp.local autocompletes by default

Fully qualified domain name (FQDN) for target host: = loginsight-01a.corp.local

Click OK

Test DNS Alias

HOL-SDC-1431 82
From the Control Center Desktop launch the Windows Command Prompt

Clear DNS

To make sure we are getting the most up to date DNS results type, 'ipconfig /flushdns'
and press enter.

Ping LOGINSIGHT

HOL-SDC-1431 83
Type "ping loginsight' and press enter (note: The alias we created is NOT case
sensitive)

If all went well with your Alias creation you should get a positive ping response from
loginsight-01a

Click X to close the Windows Command Prompt

Close Windows DNS Manager

Click X to close Windows DNS Manager

HOL-SDC-1431 84
Switch back to Loginsight-01a

Select the Loginsight-01a browser tab from the Windows Task Bar

Select the Agents Management Page

We are now going to do some work in the Agents Management section of Log Insight

HOL-SDC-1431 85
You can get to the Agents Management page by:

Clicking on the Menu icon on the top right

Clicking on Administration

Selecting Agents from the left hand navigation pane

Agents

Observe that there is No Agent Data Available

Click Download Log Insight Agent Version 2.5.0

HOL-SDC-1431 86
Download Log Insight Agent Version 2.5.0

Click on Windows MSI (32-bit/64-bit)

Save file

Click Save File

HOL-SDC-1431 87
Launch the Log Insight Agent Installer

Click on the downloads arrow in firefox

Click on VMware-vCenter-Log-Insight-Agent

HOL-SDC-1431 88
VMware vCenter Log Insight Agent Setup - EULA

I accept the terms of the License Agreement: Check

Click Next

HOL-SDC-1431 89
VMware vCenter Log Insight Agent Setup - Server Configuration

Host: LOGINSIGHT (Default)

Click Install

HOL-SDC-1431 90
VMware vCenter Log Insight Agent Setup - Finish

Click Finish

Close the Download Agents Selection Box

Click X to close the Download agents selection box

HOL-SDC-1431 91
Refresh the Agents information page

Refresh the browser page

Observe that the ControlCenter Server is now sending it's logs to Log Insight

Configuring the Log Insight Windows Agent after Installation

After the Log Insight Windows agent is installed, there are a couple of ways to change
which logs the agent collects. By default, the agents is not configured to collect the
Windows Firewall log. In the next few steps we will modify the Log Insight Agent file to
include the Windows Firewall Log.

Note: A log stream is also referred to as a channel.

HOL-SDC-1431 92
Launch Windows File Explorer from the ControlCenter desktop taskbar

Open the Log Insight agent .ini file

In the path selection box type C:\ProgramData\VMware\Log Insight

Agent\liagent.ini

Press Enter

HOL-SDC-1431 93
Add a Windows Events Channel

Append the following text to the end of the liagent.ini file

[winlog|Events_Firewall]

channel=Microsoft-Windows-Windows Firewall With Advanced

Security/Firewall

enabled=yes

HOL-SDC-1431 94
Save and exit Notepad

Click Save

Click Exit

HOL-SDC-1431 95
Centralized Windows Agent Configuration

An alternative to modifying the .ini file is to use the Agent Configuration Utility.
Changes made in the Agent Configuration Utility will be propagated to all Windows &
Linux Agents. Configuration information that does not apply to the local agent is ignored.
I.e. The Linux agents would ignore the configuration for the Windows Firewall.

Add the following text to the Agent Configuration Window

[winlog|Events_Firewall]

channel=Microsoft-Windows-Windows Firewall With Advanced Security/Firewall

enabled=yes

Click Save Configuration for All Agents

We're all done with Windows agent. Let's move on to installing the Linux Agent.

HOL-SDC-1431 96
Installing and Managing Linux Agents (New
in v2.5)
In previous versions of Log Insight we would configure 3rd party syslog clients on Linux
machines to re-direct their syslog data to Log Insight. Log Insight 2.5 introduces a native
VMware Log Insight agent.
Advanced features from a native Linux Agent:
 Properly send multi-line messages

 Event tagging

 Proper handling of log rotation

 Added resilience to network and server-side resource contention

Launch the vSphere Web Client

Now, let's go install the new agent on a Linux guest.

Open a new tab in Firefox

Enter the following URL: https://vcsa-01a.corp.local/vsphere-client

HOL-SDC-1431 97
Login to the vSphere Web Client

User name: root

Password: VMware1!

Click Login

Launch vCenter

HOL-SDC-1431 98
Click on vCenter

VMs and Templates

Click on VMs and Templates

HOL-SDC-1431 99
Ensure that Sles-01a is Powered On

In the left hand navigation pane, navigate to vCenter\VMs and Templates\Sles-01a

The VM should already be running, if it's not, start it now

Click on Launch Console

HOL-SDC-1431 100
Log into Sles-01a

Click on the Firefox browser tab labeled sles-01a

Username: root

Click Log In -or- Press Enter

HOL-SDC-1431 101
Log into Sles-01a

Password: VMware1!

Click Log In -or- Press Enter

Open root's Home Directory

HOL-SDC-1431 102
On the desktop of Sles-01a Double Click on root's Home folder

Open the Documents folder

Double Click on the Documents folder

Observe the different versions of the Linux agent

There are three different versions of the Linux agent:

HOL-SDC-1431 103
.deb = Debian installation package

.rpm = RPM installation package

.bin = Linux standalone installation package

We have previously placed all three installers in the root users Documents folder. In
reality you would put these out on a file share or use a scripting tool like Puppet to
distribute and install the agent on your Linux guests.

Install the Log Insight Linux agent

Double Click on VMware-Log-Insight-Agent-2.5.0-2347850.noarch.rpm

Local file installer is running as a privileged user

HOL-SDC-1431 104
Click Continue Anyway

Do you want to install this file ?

Click Install

Authenticate

Password for Root: VMware1!

Click Authenticate

HOL-SDC-1431 105
File was installed successfully

This dialogue box will go away on it's own.

If you are ludicrously impatient, like me, click close.

Confirm that the Log Insight agent has been installed

HOL-SDC-1431 106
Click Go

Click Location

Go To: /var/lib/loginsight-agent/

In the Go To: box type /var/lib/loginsight-agent/ (Note: The name should

autocomplete for you after you type the first few characters)

Press Enter

loginsight-agent - File Browser

Observe that the log insight agent binaries have been installed

Now, let's head over to Loginsight-01a and ensure that the agent is registered and sending
logs

HOL-SDC-1431 107
Note: Do not close the console session browser tab with Sles-01a we'll come back here
a little later to further investigate agent configuration

Switch Over to loginsight-01a browser tab

Click on the Firefox browser tab for Loginsight-01a

Refresh the Agents information page

Refresh the browser page (If Neccessary)

Observe that full-sles-01a is now sending it's logs to Log Insight

HOL-SDC-1431 108
Switch back over to the Sles-01a console tab

Cick on Sles-01a

Open the liagent.ini file

Double Click liagent.ini

HOL-SDC-1431 109
liagent.ini settings

liagent.ini default settings:

hostname = LOGINSIGHT

protocol = cfapi (alternative option is syslog)

port = 9000

HOL-SDC-1431 110
liagent.ini settings (cont.)

ssl = no (Default)

max disk buffer = 200MB (Max agent buffer size on disk)

logging = debug_level=0

HOL-SDC-1431 111
liagent.ini settings (cont.)

[filelog | messages] (var log)

[syslog | messages] (var log \ sys log)

Note: Log Insight will only collect logs that are present on the system. It will ignore logs
that are not present. You can also specify any additional log paths that you would like to
capture as well.

HOL-SDC-1431 112
Close liagent.ini

Click on the X to close liagent.ini

Note: The liagent service will automatically pick up any changes to the liagent.ini file. No
service restart is necessary.

Open liagent-effective.ini

Double Click liagent-effective.ini

HOL-SDC-1431 113
Observe the effective configuration of the Log Insight agent

The local Log Insight agent configuration is merged with the server side configuration to
create the effective configuration. The effective configuration can be seen here, in the
liagent-effective.ini. Note: that the windows firewall changes we made using the
LogInsight Agent configuration utility are part of the effective configuration. The LogInsight
agent will ignore logs that it does not find on the guest.

HOL-SDC-1431 114
Close liagent-effective.ini

Click X to close the liagent-effective.ini

HOL-SDC-1431 115
Navigate to GNOME Terminal

Click Computer

Click on More Applications...

Launch GNOME Terminal

1. Type in terminal to the filter

2. Click on GNOME Terminal

HOL-SDC-1431 116
Check the status of the Log Insight Agent service

Type service liagentd status

Press Enter

We have now configured this linux guest to send its logs to the Log Insight Server for
processing.

Test Linux Logging

Type logger Hello World

Press Enter

This will write "Hello World" out to the system log

HOL-SDC-1431 117
Restart the Log Insight Agent Service

Type service liagentd restart

Press Enter

Switch Over to loginsight-01a browser tab

Click on the loginsight-01a browser tab

HOL-SDC-1431 118
Select Interactive Analytics

Click on the Interactive Analytics tab

Filter for logs from full-sles-01a (The full name of Sles-01a)

Click Add Filter

Select: Hostname

Select: contains

Type: full-sles-01a

Press Enter

Observe that logs from full-sles-01a are being sent to Log Insight for processing

This concludes the section of the lab on Installing and Configuring Linux Agents

HOL-SDC-1431 119
HOL-SDC-1431 120
Configuring Active Directory Integration
Log Insight supports integration with Active Directory. When configured, Log Insight can
authenticate or authorize a user against Active Directory. When you create new user
accounts by using the built-in authentication method, you provide users with passwords
that they must use to log in to Log Insight. To avoid having users remember multiple
passwords, you can enable the support for Active Directory authentication.

Enabling Active Directory Integration

In the top, right hand corner of the Log Insight UI, click on the menu icon

Click on Administration

HOL-SDC-1431 121
Configuration -> Authentication

In the left hand navigation pane click on Authentication

HOL-SDC-1431 122
Authentication Configuration

Enable Active Directory support: Check

Default Domain: corp.local

Username: Administrator

Password: VMware1!

Click Test Connection (Success)

Click Save

HOL-SDC-1431 123
Adding Active Directory Users and Groups to Log Insight

In the left hand navigation pane, click on Access Control

HOL-SDC-1431 124
Add an Active Directory User to Log Insight

Click on + New User

New User

Authentication: Active Directory

Domain: corp.local

Username: Loginsight

HOL-SDC-1431 125
Role: Super Admin

Click Save

Add an Active Directory Group to Log Insight

Click on +New Group

HOL-SDC-1431 126
New Group

Domain: corp.local (default)

Name: Loginsight Users

Role: User (default)

Click Save

Complete: We can now use Active Directory Users and Groups when assigning rights
and privileges within Log Insight.

Let's move on to installing additional content packs.

HOL-SDC-1431 127
Installing Content Packs
Content packs contain dashboards, extracted fields, saved queries, and alerts that are
related to a specific product or set of logs.
Some content packs such as the VMware - vSphere content pack are loaded by default
others can be downloaded from Log Insight Content Pack Marketplace. In this section we
will:
 Investigate available Content Packs

 Update Installed Content Packs

 Import Content Packs for vRealize Operations, vRealize Automation and NSX

Managing Content Packs

In the top, right hand corner of the Log Insight UI, click on the menu icon

Click on Content Packs

HOL-SDC-1431 128
Log Insight Content Pack Marketplace

The lab environment isn't connected to the internet.

HOL-SDC-1431 129
Log Insight Content Pack Marketplace

If the lab environment were connected to the internet this is what we would see.

There are lots of great content packs available from the Content Pack Marketplace.

HOL-SDC-1431 130
VMware - vSphere Content Pack

Click on VMware - vSphere in the left hand navigation pane

Observe that the VMware - vSphere Content Pack version 2.5 is installed

Log Insight General Content Pack

Click on General in the left hand navigation pane

Observe that the General Content Pack version 2.5 is installed

HOL-SDC-1431 131
Import the vCenter Operations Manager Content Pack

On the bottom of the left hand navigation pane, click on the button Import Content
Pack

HOL-SDC-1431 132
Import Content Pack

Select Import into My Content

Click Browse

HOL-SDC-1431 133
File Upload

Browse to C:\Users\Administrator\Downloads\Log Insight Content Packs

Click on VMware_-_vCenter_Operations_Manager.vlcp

Click Open

HOL-SDC-1431 134
Import Content Pack

There are two options when installing a content pack.

Install as content pack

Description - The content is imported as a read-only content pack that is visible to all
users of the Log Insight instance.

Note: Content pack dashboards are read-only. You cannot delete or rename them.
However, you can clone content pack dashboards to your custom dashboard. You can
clone whole dashboards or individual widgets.

Import into My Content

Description - The content is imported as custom content to your user space, and is
visible only to you. You can edit the imported content without having to clone it.

Note: Content pack metadata, such as name, author, icon, and so on, are not displayed in
this mode. Once imported in My Content, the content pack cannot be uninstalled as a
pack. If you want to remove a content pack from My Content, you have to individually
remove each of its elements, such as dashboards, queries, alerts, and fields.

Let's choose Import into My Content and see what happens.

HOL-SDC-1431 135
Click Import

Import to My Content

Click Import

HOL-SDC-1431 136
My Content

In the left hand navigation pane, click on My Content

HOL-SDC-1431 137
Success - VMware - vCenter Operations Manager Content Pack
Installed to My Content

Observe that VMware - vCenter Operations Manager specific widgets are now
available in My Content

HOL-SDC-1431 138
Import the vCloud Automation Center Content Pack

On the bottom of the left hand navigation pane, click on the button Import Content
Pack

Import Content Pack

Now, let's choose Install as content pack to see the difference.

Select Install as content pack

HOL-SDC-1431 139
Click Browse...

File Upload

Browse to C:\Users\Administrator\Downloads\Log Insight Content Packs

Click on VMware_-_vCAC_6.0.vlcp

Click Open

HOL-SDC-1431 140
Import Content Pack

Click Import

Succes - VMware - vCloud Automation Center 6.0 Content Pack

Installed

HOL-SDC-1431 141
Observe that the VMware - vCloud Automation Center 6.0 content pack is installed.

Import the NSX Content Pack

On the bottom of the left hand navigation pane, click on the button Import Content
Pack

Import Content Pack

HOL-SDC-1431 142
Now, let's choose Install as content pack to see the difference.

Select Install as content pack

Click Browse...

File Upload

HOL-SDC-1431 143
Import Content Pack

Success - VMware - NSX-vSphere Content Pack Installed

Observe that the VMware - NSX-vSphere content pack is installed.

Complete: We now have three additional content packs installed on the Log Insight
Server.

HOL-SDC-1431 144
End of Module: We are now finished installing and configuring Log Insight. For more
information on Log Insight, take HOL-SDC-1426 - Log Insight In the Real World.

HOL-SDC-1431 145