Jon Herlocker

Log Insight Now Understands More of your IT Environment with Partner Content Packs

August 15, 2013

In my last post, I introduced VMware vCenter Log Insight. Since announcing the public beta and subsequent GA of Log Insight, we’ve seen tremendous response from the community with more than thousands of downloads within the first four weeks of availability.

We’ve been very pleased with the results that customers are seeing – often within an hour of downloading the appliance. One of my recent favorites was a customer who was able to quantify using Log Insight the impact their virtual machine backup processes were having on their application performance.

We’re on a mission to make log files and unstructured data universally accessible for all our customers and provide total awareness of the entire IT environment. We want to provide you with the analytics that allow you to make sense of the data you’re collecting in your infrastructure, and apply that knowledge to improve IT Operations and other use cases down the line such as security and compliance management.

For those unfamiliar with this product, Log Insight works by ingesting large quantities of unstructured machine-generated data and enabling you to quickly analyze that data – search, aggregate, and visualize those large sets of data so you can get to that proverbial needle in a haystack.

With Log Insight, you can rapidly explore data, discover the structure and content, and apply that structure with the assistance of Log Insight’s automated mechanisms. Once that has been done, you can then query the formerly unstructured data like a database.  You can make changes to the structure on the fly without having to rebuild, export, import or anything like that. You just change the structure and you can immediately query all historical data with the new structure.

But we understand that not everybody has the time to explore their data, apply structure, and the like.  So we introduced the concept of Content Packs. With a Content Pack, you can package and share knowledge about logs. When you load a Content Pack into Log Insight, you immediately get a collection of dashboards, saved queries, alerts, and field definitions. Log Insight comes out of the box with a vSphere Content Pack – so minutes after installing Log Insight, you can review dashboards, saved queries, and saved alerts that provide you insight into possible issues in your vSphere installation. You don’t need to be an expert in vSphere debug logs, and you don’t need to spend time learning before you get to your first insights.

vSphere is only one component in your IT environment – you have servers, storage arrays, network switches, and many different layers of software up through your application level. Problems and inefficiencies can occur in all of these components. Even without Content Packs, Log Insight will enable you to correlate issues with logs originating from all of those sources, but total awareness will only come when you have the created the right dashboards and alerts for each of those components.

We’re excited to announce that a first round of VMware partners spanning storage, compute, networking, and security and compliance software are now shipping Content Packs for Log Insight. With these Content Packs from Cisco, EMC, HyTrust, NetApp, NetFlow Logic, Puppet Labs and VCE you’ll get a new level of visibility across all the components of your IT ecosystem that didn’t exist before. These Content Packs are available free of charge from the Log Insight page on the VMware Solutions Exchange.

To better understand the benefits that VMware partners are bringing to Log Insight, let’s take a glimpse at the EMC VMAX Content Pack. The VMAX array emits a broad range of informative events, from I/O threshold violation events to configuration change events, to component failures, to snap-management events. With the VMAX Content Pack installed in Log Insight, you immediately get an understanding of can be learned from the VMAX logs, as well as a collection of useful dashboards out of the box. Here is a screenshot showing a few of the charts from the Overview dashboard:

Traditionally, correlating issues in vSphere or your application to events or issues in storage is challenging and manual. With Log Insight and the new EMC VMAX Content Pack for Log Insight, you can now easily monitor logs from your VMAX arrays, correlate the VMAX logs with all your other logs in Log Insight, and leverage your metrics within VMware vCenter Operations.  So if vSphere reports high latency warnings (part of the vSphere content pack), with the VMAX Content Pack you can immediately look for correlated events from an associated VMAX storage array.

To download available Content Packs, please visit the VMware Solution Exchange.  You’ll see Log Insight Content Packs for partner solutions and other VMware products.

And for those that are not running Log Insight, what are you waiting for?! You can download a free evaluation copy at the Log Insight product page. In less than an hour you will be getting your first insights, and with partner Content Packs those insights will not just be about your vSphere environments, but also your across your wider IT ecosystem.

Finally, if you are one of those cutting-edge types, I encourage you to submit your name to join the Log Insight Technology Preview Program. Those selected will get access to pre-release versions of Log Insight and have the opportunity to provide us with early feedback and guidance.

Analyze away!

Jon Herlocker

Jon Herlocker

Jon Herlocker works on technology strategy at VMware and currently is responsible for all research and development of the new vCenter Log Insight product. In prior roles he was CTO and VP of Engineering of Mozy and CTO of the EMC Cloud Services Division ... More

Leave a Reply