Recommended Read –


VMware has a lot of products that compose the SDDC stack. Out of all of them — after the foundational ESXi — vRealize Log Insight had become my absolute favorite product. It is one of the first things I deploy inside any new environment, as soon as vCenter Server is online and sometimes before. It’s ability to parse, collect and search log messages throughout the stack, while providing easy-to-use dashboards make it so much more powerful than some of its competitors.

Steve Flanders blogs about several VMware-related topics, and the Log Insight posts are the highlight of his site. Oftentimes his site is my first stop when I have a question — even before the documentation.

Steve has a quick reference for his Log Insight posts, which can be found here.

The power of Log Insight can easily be realized within any environment and becomes even more powerful with the installation of the Content Packs. Content Packs can be downloaded through the UI interface directly and include components for both VMware products and industry products.

Some of the Content Packs I find myself relying on include:

  • VMware NSX
  • OpenStack
  • Synology (for the home lab users out there)
  • Nginx
  • vRealize Operations

There are dozens more and it is possible to even write your own content packs. The VMware Developer Center provides information on how to do so.

If you are thinking about using Log Insight or just looking for new information to learn how to better utilize it in your environment, I highly encourage you head over to and check out all the resources there. Also give Steve a follow over on Twitter.


Configure Log Insight Agent on Big Data Extensions



Let’s be honest, debugging error messages generated by VMware Big Data Extensions (BDE) can be painstaking, tedious and tiresome. Having recently begun to rely on VMware Log Insight more and more, I determined the deployment of BDE v2.3.1 would leverage the Log Insight agent. During the actual vApp deployment of BDE, you may have noticed an option to specify a remote syslog server. I chose to leave the option blank during the deployment, instead choosing to install and configure the Log Insight agent post-installation.

The Linux Log Insight agent can be downloaded on the Administration->Agents screen at the very bottom of the screen.


The download link will include the IP address of the Log Insight server and is used during the RPM deployment of the agent.

Management Server Installation

The BDE management server is currently running CentOS 6.7. After copying the agent to the management server, the following commands can be executed to install and perform the service configuration.

# rpm -ihv VMware-Log-Insight-Agent-3.0.0-2985111.noarch_192.168.1.2.rpm
# chkconfig liagentd --list
# chkconfig liagentd on
# service liagentd restart

After the installation is complete, the BDE management server should appear in the list of servers with installed agents.


The next thing to do is begin editing the /etc/liagent.ini configuration file to send the Serengeti log files to the Log Insight server. Mr. Steve Flanders has an article from 2014 that describes the process of adding custom log files for the agent to parse.

 41 [filelog|syslog]
 42 directory=/opt/serengeti/logs
 43 include=serengeti.log;ironfan.log
 44 event_marker=\[\d{4}-\d{2}-\d{2}T

BDE Template Installation

Having the Log Insight agent installed on the BDE management server is helpful, but I determined having the agent installed natively during the all deployments of Hadoop and Apache Mesos clusters would be even more helpful. There were two options for installing the agent during deployments:

  1. Create a Chef cookbook and include the Log Insight agent RPM file on the management server repo.
  2. Install and configure the agent on the template VM itself.

I opted for option #2, merely because it would be the quickest way initially. Admittedly, using a Chef recipe would have been the better long-term and more “DevOps-y” way to perform the installation. I may reconsider my choice in the future.

Just like the management server installation process, copy the Log Insight agent RPM file onto the template and install it using the same steps. No modifications to the /etc/liagent.ini file are necessary for the VM template node because the Serengeti logs don’t exist.

Be sure to delete the snapshot on the VM template node so the changes take effect.

Now all of the VMs deployed through VMware Big Data Extensions will immediately send log updates to Log Insight and the logs for all of the deployments are now captured as well. Having the logs accessible through Log Insight let you parse them with the power of the Log Insight UI and the filtering capabilities there.