Log Analytics Log Insight

Announcing vCenter Log Insight 2.0: Scalable, Fast Log Management that does Windows

We’re pleased to announce the release of VMware® vCenter™ Log Insight™ 2.0, VMware’s premier Log Management product. You can read the press release here. Update: You can download the evaluation for Log Insight 2.0 here. (If you are a customer, you can download the upgrade here.)

Log Insight represents the next generation in log management technology from VMware. For this release, we focused on three main areas: Performance, Windows and Machine Learning. We have exciting new features in all 3 areas.

(Check out Jon Herlocker’s in-depth post here.)


To say we’ve improved performance in Log Insight 2.0 is an understatement. We’ve spent a lot of time in this release cycle focusing on measuring and improving the performance of Log Insight, and we’ve improved it in two very important ways.

First, after some rigorous 3rd party testing, we found out that we’re at least six times (6X!) faster than the leading solution. (and you know who that is). We did testing that involved normal queries across billion record data sets. (yes, billion). If you’d like more details, contact VMware Sales, or your local VMware Cloud Management Specialist.

Second, with the advent of clustering, we’ve improved scale out performance as well as data ingest performance. The gallant men and women of the Log Insight R&D team have improved individual node ingest performance by up to 30%. Along with that, it is now possible to ingest data across a cluster of up to 6 nodes, essentially giving you up to 8X faster data ingestion than before.

Screen Shot 2014-03-23 at 1.56.32 PM-dashboard
A Sample Log Insight 2.0 Dashboard


For enterprises, the arrival of the Windows Logging Agent will greatly help data centers keep control of their far-flung deployments of Windows. With more than 500,000,000 Windows desktops out there, a light-weight agent is a necessity. And that’s exactly what we built. This little, 4 Meg, Windows service can be easily deployed en masse by the standard Windows deployment tools, and can be configured via the Log Insight 2.0 Console.

Machine Learning

Log Insight 2.0 represents the first in a long line of Machine Learning innovations coming not only from this product, but across the VMware product spectrum.

Log Insight 2.0 is a significant step in this direction. It helps user detect patterns in log messages more quickly. Essentially, it reads each message as it comes in, and attempts to determine the message’s structure. It then compares this to the structure of other messages it has seen. In doing this, it is able to classify messages by “type”.

How does this help? It helps by cutting down the number of messages a user has to look at. For example, Spiros, in R&D recently did a test with a 40 Billion message dataset from several ESX hosts. When Log Insight 2.0 finished analyzing it, it ended up with only 10 types of messages, and it was possible to easily determine a disk related problem.

A Recap: Why is Log Insight valuable?

IT organizations today are challenged with managing and mining logs for operational insights in real-time dealing with a high volume of log data and the dynamic nature of data structures. Unstructured log data contains valuable operational and diagnostics details regarding IT infrastructure and applications that can be applied to identify the root cause of an issue and then troubleshoot. Real-time log analytics and management solves a blind spot in cloud operations by providing IT organizations with a broader view into what is happening within a cloud infrastructure at an exact moment.

A sample query and stacked bar chart in Log Insight 2.0
A sample query and stacked bar chart in Log Insight 2.0

Recap 2: What Are Content Packs

Since the early days of the software industry, in has been important to make products “extensible,” meaning that they should have the ability to be extended to do things be people other than the folks building the product.

Log Insight 2.0 content packs encapsulate pre-defined log queries, extracted fields, pre-built dashboards and product-specific alerts helping joint customers to pinpoint IT issues rapidly and simplify troubleshooting. Partners, product experts and users can easily produce content packs without any coding using vCenter Log Insight. Available at no charge, content packs are downloadable from the Log Insight Marketplace on the VMware Solution Exchange.  For a primer on how to build Content Packs, see Steve Flanders’ paper on the Log Insight 2.0 product page.


In summary, the new product release of Log Insight 2.0 focuses on:

  • Intelligent Grouping – a new machine learning-based technology that automatically groups related data to help administrators to spot problems more rapidly and reduce time-to-resolution
  • Query Performance – 6x faster query performance than the market leading solution (according to internal tests) will improve administrators and IT operations team productivity levels.
  • Data Ingestion – dramatic improvements in data collection enable 8x faster data ingestion to speed visibility and awareness across more of customer physical, virtual and cloud environments
  • Data Visualization – new data visualization capabilities in the form of tables and chart types will provide administrators with increased options for analyzing unstructured log data
  • Windows Support – a new native Microsoft Windows agent now collects logs from Windows-based desktops and servers enabling customers to now capture and analyze log data across all key environments.
  • UI Improvements – the UI has been improved with a sleek new look and feel

Log Insight simply represents the next generation in log management technology from VMware.

<div style=”display:inline;”>
<img height=”1″ width=”1″ style=”border-style:none;” alt=”” src=”//googleads.g.doubleclick.net/pagead/viewthroughconversion/993433657/?value=0&amp;label=BD54CMeexwQQubDa2QM&amp;guid=ON&amp;script=0″/></div>


2 comments have been added so far

Leave a Reply

Your email address will not be published. Required fields are marked *