VMware vCenter Log Insight
VMware

VMware vCenter Log Insight 1.0 Release Notes

vCenter Log Insight 1.0 | Build 1169900

Last Document Update: 10 SEP 2013

Check frequently for additions and updates to these release notes.

These release notes include the following topics:

Introduction

VMware vCenter Log Insight is the new solution of VMware for log management and analytics for dynamic hybrid cloud environments. It delivers superior technology for automated log management through log analytics, aggregation, and search to extend the leadership of VMware in analytics to log data. Log Insight can analyze vast amounts of unstructured machine generated data and enable interactive, real-time search and analytics through an easy to use interface providing superb time to value. It analyzes log data of all types and from all devices, enabling deep, enterprise-wide visibility. With a focus on integrated cloud operations management, and an analytics driven approach, Log Insight provides the operational intelligence needed to proactively enable service levels and operational efficiency in dynamic hybrid cloud environments.

Key Features

  • Powerful indexing for fast analytical queries

  • Intuitive, easy to use Interactive Analytics user interface

  • On the fly, one-click, schema creation

  • UI driven query building

  • Flexible dashboards

  • Rate based alerting

  • Virtual appliance form factor for easy deployment and management

  • Integration with the VMware vCenter Operations Manager for complete end-to-end operations management

  • Built-in knowledge of vSphere logs

  • Support for archiving logs in compressed format

  • Easy to use administration interface

  • Top of Page

    Before You Begin

    Review this section before you begin installing and configuring Log Insight.

    Virtual Appliance Deployment

    Always use a VMware vSphere Client to connect to a VMware vCenter Server and deploy the Log Insight virtual appliance through the vCenter Server. The Log Insight virtual appliance should be deployed on an ESX/ESXi host version 4.0 or later that is managed by VMware vCenter Server 4.0 Update 2 or later.

    Licensing Log Insight 1.0

    This paragraph contains notes on licensing Log Insight 1.0.

    • After you deploy the Log Insight vApp, you must assign a valid license key.
    • All license management tasks are performed in the Administration Web interface of Log Insight. The URL is http://<log-insight-ip>/admin/license, where <log-insight-ip> is the IP address of the Log Insight vApp. Follow the instructions from the vCenter Log Insight Installation and Administration Guide to assign a license.

    Top of Page

    Product Compatibility and Requirements

    Log Insight 1.0 supports the following VMware products and versions:

    • Log insight can pull events, tasks, and alarms data from VMware vCenter Server 4.1 and later.

    • You can configure ESXi hosts of the following versions to push syslog data to Log Insight: ESXi 4.0, 4.1, 5.0, and 5.1.
      You use the configure-esxi utility on the Log Insight virtual appliance to configure syslog feeds from ESXi hosts. Follow the instructions from the vCenter Log Insight Installation and Administration Guide.

    • vCenter Server Appliance 5.1 can be configured to push data to Log Insight.

    • You can integrate Log Insight with vCenter Operations Manager as follows.
      • Log Insight can send notification events to vCenter Operations Manager 5.6, 5.7, and 5.7.1
        Note: You cannot view the details of Log Insight alerts in vCenter Operations Manager 5.6.
      • You can enable launch in context for Log Insight in vCenter Operations Manager 5.7.1. Launch in context allows vCenter Operations Manager to launch Log Insight with an object-specific query that corresponds to a Log Insight notification event.

      See section Integrating Log Insight with Other VMware Products of the Log Insight in-product help.

    Browser Support

    Log Insight 1.0 supports the following browser versions:
    • Mozilla Firefox 10.x, 19.x, 20.x, and 21.0
    • Google Chrome 27.x, 26.x, and 25.x
    • Safari 6.0
    • Internet Explorer 9.x and 10.x
      • Compatibility mode is not supported and must be disabled.
      • Quirks mode is not supported and must be disabled.
      • Internet Explorer 10 must be used in "Standards Mode". Other modes are not supported. Compatibility View is not supported.

    The minimum supported browser resolution is 1024 by 768 pixels.

    Top of Page

    Limitations

    Log Insight 1.0 has the following limitations:
    • Log Insight does not handle non-printable ASCII characters properly.
    • Log Insight does not support multi-line messages
    • Extended regex syntax is not supported.
    • Log Insight 1.0 does not provide backward compatibility to the technology preview or beta releases of Log Insight.

    Security

    IT decision makers, architects, administrators, and others who must be aware of the security components of Log Insight must familiarize themselves with the VMware vCenter Log Insight 1.0 Security Guide.

    For details on how to secure your environment, check the VMware vSphere Security guide and the VMware Security Advisories site.

    Virtual Appliance Requirements

    The following section lists the computing requirements and assumptions for the Log Insight virtual appliance.
    • Memory: 8GB RAM
    • vCPU: 2 vCPUs, 2GHz each
    • Storage space: approximately 140GB, including a 100GB volume for storing log data

    User Accounts

    • To pull events, tasks, and alarms data from a vCenter Server, you must provide a set of user credentials for that vCenter Server. The minimum role required to register and unregister Log Insight with a vCenter Server is Read-only, set at the vCenter Server level, and propagated to child objects .
    • The hosting vCenter Server credentials are needed to deploy the Log Insight virtual appliance.
    • The default credentials for the Log Insight Admin user are admin/<blank>. To improve security, Log Insight requires you to change these credentials when you first access the Log Insight Web user interface.
    • The default credentials for the root user on the Log Insight virtual appliance are root/<blank>. You are prompted to change the admin and root account passwords when you first access the Log Insight console terminal.
      Note: SSH access to the virtual appliance is disabled until you change the root password. Follow the procedure from the vCenter Log Insight Installation and Administration Guide.
    • To enable notification events and the launch in context functionality in a vCenter Operations Manager instance, you must provide user credentials for that vCenter Operations Manager instance.

    Top of Page

    Upgrading from a Previous Version of Log Insight

    Log Insight 1.0 does not support upgrading from technology preview or beta versions.

    Internationalization Support

    Log Insight 1.0 has not been officially internationalized. It has been tested in English only.

    Log Insight 1.0 should work properly in non-English web browsers, as long as data input is in English.
    Following is information on use cases that have been tested.

    • The Log Insight Web user interface was accessed successfully via Chinese and German version of the Firefox browser.
    • The non-ASCII users with non-ASCII password are created and logged into the UI successfully.
    • The non-ASCII name for other object names, such as the Saved dashboard and the Saved Query, are created and displayed successfully.
    • The non-ASCII log contents (with various encodings, such as UTF-8, UTF-16, and native ANSI encoding) were displayed garbled on the Log Insight Web user interface.
    • Due to the issue with the garbled non-ASCII log contents, the search and filtering features for those non-ASCII log contents won't be performed.
    • The date/time format for various timestamp and calendar shown on the Log Insight user interface are in English, even though the OS and browser are in Chinese and German.
    • No Log Insight message is externalized.

    Top of Page

    Known Issues

    This section contains known issues for this release.

    Deployment

    • You cannot specify static networking properties for the Log Insight virtual appliance
      The configuration of networking properties for the Log Insight virtual appliance requires vApp options. As such, the Log Insight virtual appliance must be deployed to a vCenter Server or vCloud Director instance. Deploying the Log Insight virtual appliance to ESX/ESXi, Fusion, or Workstation is not supported.
      Workaround: Deploy the Log Insight virtual appliance to a vCenter Server or vCloud Director instance.

    General

    • The Health page does not display any metrics about data that is imported from archived NFS locations
      If you import archived log data in a Log Insight instance, you cannot use the Health page to check the amount of log data and the count of events that were imported from the archive location. The Health page on the Administration UI tracks only live log data.
      Workaround: Use the Interactive Analytics tab to check the number of imported events.
      Note: If the imported data is mixed with live syslog feeds, you might not be able to easily gather information about imported data from the Interactive Analytics tab. Do not mix live syslog feeds with imported data in a single Log Insight instance.

    • You cannot check the status of an import operation if your user session ends before the end of the import
      To start the data import process, you connect to a Log Insight instance through a SSH session or through the virtual appliance console. The data import process may take a long time. In the case of SSH, if the SSH session gets dropped or you close the SSH session before the import process completes you are not able to check whether the import completed successfully.
      Workaround: Install a "screen" package on the Log Insight virtual appliance. This package allows you to run the linux processes in the background without interruption, even when you disconnects from the SSH session.

    • The import of archived log data might fail if Log Insight cannot access the NFS server where data is stored
      If, during the data import process, the NFS server becomes inaccessible due to network failure or errors on the NFS server, the import of archived data might fail.
      Workaround: None

    • The import of archived data might fail if the Log Insight virtual appliance runs out of disk space
      The Log Insight repository import utility does not check for available disk space on the Log Insight virtual appliance. Therefore, the import of archived logs might fail if the virtual appliance runs out of disk space.
      Workaround: None

    • Log Insight does not display progress information during log imports
      As the import of archived data is in progress, you are unable to infer from the console output how much time is left before the import finishes or how much data is already imported.
      Workaround: None

    • Log Insight might run out of disk space even though data archiving is enabled
      If the network connection to the NFS storage is slow, and the rate of the incoming data is higher than the data archiving rate, Log Insight might run out of disk space.
      Workaround: None

    • Multi-line messages that are sent to Log Insight though syslog from ESXi hosts and other applications are split incorrectly
      By default, the syslog protocol supports only single line messages, so each line of a multi-line message is sent as a separate message. This creates problems with field extractions, aggregation, and analysis of multi-line messages.
      Workaround: None

    • You can see messages related to launch in context even if launch in context is not enabled or not supported in the vCenter Operations Manager version that you use
      The details of Log Insight notification events that appear in vCenter Operations Manager UI contain the following message that suggests using the launch in context feature:
      Log Insight found <Number> messages matching the criteria for alert "<Name of the Alert>": Use the context menu item to review the matches in Log Insight.
      This message is displayed even if you have not enabled launch in context, or if you are using vCenter Operations Manager versions earlier than 5.7.1 that do not support launch in context.
      Workaround: Ignore the message if launch in context is not enabled in your instance of vCenter Operations Manager. Open a browser and type the IP address of the Log Insight virtual appliance to search for matching messages related to the notification event.

    • The alert criticality setting for notification events is ignored in vCenter Operations Manager Custom user interface
      When, in Log Insight, you create an alert query to send notification events to vCenter Operations Manager, you can modify the level of alert criticality displayed in the Custom user interface. However, all notification events appear as Info, regardless of your settings.
      Workaround: None.

    • Email notifications might be dropped if you use the default SMTP settings of Log Insight
      If, in the Log Insight administration interface, you leave the default SMTP settings of localhost:25, the email notifications that Log Insight sends might be dropped by the receiving email server, such as Yahoo or Gmail.
      Workaround: Use the Send Test Email option and ensure you receive an email to validate that email notifications are not being dropped.

    • Unable to set the root ssh password of Log Insight in the VMware Remote Client Console (VMRC)
      If you open the VMRC from the vSphere Client or from the vSphere Web Client from a wide-area or low-bandwidth connection, the time delay over the network may be long enough to cause the virtual machine to start auto-repeat. This might prevent you from setting the root password in the VMRC console.
      Workaround: Increase the time threshold necessary for auto-repeat in the remote console. See Repeated characters when typing in remote console (KB 196).

    • You cannot change the network properties of the Log Insight virtual appliance at run time
      Log Insight does not support changing the IP address, network mask, gateway, DNS, or hostname of the virtual appliance at run time.
      Workaround: Network configuration changes are only supported from the vApp options of the Log Insight virtual appliance.
      1. Open a vSphere Client and locate the Log Insight virtual appliance.
      2. Shut down the virtual appliance.
      3. Right-click the virtual appliance, select Edit Settings, and under vApp options apply the changes to the network configuration.
      4. Power on the virtual appliance.
        Note: You must re-enable launch in context each time you change the network properties of the Log Insight virtual appliance.
    • Accessing the HTTPS-based secure web interface at https://<loginsight-host>/generates an invalid SSL certificate warning
      By default, Log Insight installs a self-signed SSL certificate. The self-signed certificate generates security warnings when you connect to the Log Insight Web user interface.
      Workaround: You can ignore these security warnings.
      If you do not want to use a self-signed security certificate, an admin user can install a custom SSL certificate. For procedure on uploading a custom SSL certificate, see the in-product help. The use of a custom SSL certificate is optional and does not affect the features of Log Insight.
    • Restart status does not change to successful after uploading a self-signed certificate
      After a self-signed certificate has been uploaded, if you restart Log Insight from the Administration Web user interface, the restart status does not change to success even after the operation has completed.
      Workaround: None
    • In charts containing group-by values other than time, if there is a large range on the Y-axis, smaller valued bars might not be visible
      As an example, if you create a chart grouped by hostname and one host has 100,000 events, and another host has 5 events, the bar for the smaller host might be too small to be visible.
      Workaround: Hover over the bottom of the chart to view the tooltips for the small bar.
    • vCenter task and event collector might exit silently

    • The total number of search results is not always accurate
      The total number of results in the event results list, for example "1 to 50 out of XXXX results", is an estimation and is not always accurate. Therefore, when clicking on a bar in the chart, the number in the event results might not match the number shown in the bar.
      Workaround: Check the number on the Y-axis of the chart. The value on the Y-axis is always correct.

    Top of Page

    Documentation Issues

    • Log Insight online help: Incorrect vCenter Server version appears in section Integrate Log Insight with VMware vSphere
      In topic "Connect Log Insight to vCenter Server 5.1.x Systems", the title and topic content refer to vCenter Server 5.1.x.
      Workaround: Should read vCenter Server 4.1 and later.
    • Log Insight online help: Missing information about importing content packs in the Log Insight Web UI
      The content packs section lacks the procedure on importing content packs in the Log Insight Web UI.
      Workaround: For information about importing content packs in Log Insight, see section Working with Content Packs of the VMware vCenter Log Insight 1.0 User's Guide.
    • Log Insight online help: Incorrect file extension of exported content packs
      The topic Export a Content Pack contains the following inaccuracies.
      • Reads: Content packs are saved as JSON files.
        Should read: Content packs are saved as vCenter Log Insight Content Pack (VLCP) files.
      • Reads: The exported JSON file appears in the location you selected.
        Should read: The exported VLCP file appears in the location you selected.
    • Log Insight online help: Missing information about enabling syslog feeds from ESXi hosts and vCenter Server Appliance
      When you first load the Log Insight Web UI, if there is no data imported, a message shows up linking you to the online help for information about setting up syslog feeds. However, the information on configuring syslog feeds is missing from the online help.
      Workaround: Please refer to the VMware vCenter Log Insight 1.0 Installation and Administration Guide.
    • Log Insight online help: Missing information on supported browsers
      When you accesses the Log Insight Web UI from an unsupported browser or operating system, a warning message displays some information on the supported browsers without version details and points you to look in the in-product help for more details.
      Workaround: For information about supported browser versions, please refer to section Product Compatibility and Requirements of the current Release Notes.

    Top of Page