VMware vRealize Log Insight is masterful in its ability to take large amounts of unstructured log data that is all too often ignored, and give it practical meaning for a data center administrator. vSAN customers benefit from this too, with a large assortment of event log dashboards that are purpose-built for vSAN. These dashboards come by way of a Log Insight “content pack for vSAN” that is shipped with the product by default.
Periodically there are updates to content packs. In this latest edition of the content pack for vSAN (version 2.2) the improvements pick up right where the previous update left off. Let’s look at a few of the new features.
What’s New
First up is a new vSAN “Overview” dashboard. This will track general activity and events that occur in user space and kernel space, as seen in Figure 1. While some vSAN processes such as I/O handling are integrated into the kernel, other processes such as management live in user-space. This is what helps give vSAN extraordinary levels of efficiency, integration and performance.
Figure 1. Log Insights vSAN “Overview” dashboard
What’s interesting about this dashboard is that one can distinguish between the categories of events, whether it be general information, warnings, or errors. Combine this with the ability to view by user space and kernel space, this gives an administrator an easy way of detecting anomalies, and identify details about those events.
Recommendation: Don’t spend an inordinate amount of time trying to determine the literal meaning of an event log string. The power of Log Insight often comes from changes in patterns or frequency of some event log data. This can be easily visualized in Log Insight as spikes (a sharp increase in the number of events) of event log information.
Up next is an all-new “Storage Policy Events.” This will track all events related to storage policies, including:
- Creating new storage policies
- Deleting existing storage policies
- Changing an assignment of a VM to another storage policy
- Modification of an existing storage policy
- Policy changes occurring at an object level
The series widgets in this dashboard, as seen in Figure 2, provides a level of visibility that was impossible to achieve in previous editions.
Figure 2. Log Insight’s vSAN “Storage Policy Events” dashboard
The vSAN engineering teams had to rework some of the event log data to accurately track these types of events, which means that this functionality is only compatible with vSAN 6.7 and newer.
Remember that storage policies are managed at the vCenter level. Any adjustments to policies (additions, changes, deletions) can easily impact VMs across one or more clusters managed by vCenter. Tracking changes through Log Insight will provide better visibility above the cluster level, and help identify the impact of changes across multiple clusters.
Updating the Content Pack
Updating a content pack has always been an easy process that occurs directly inside the application.
Figure 3. A listing of installed content packs, and available updates
While the steps to updating the content pack remain the same as with previous editions, there are a few additional steps to take to enable this new functionality – primarily the storage policy events dashboard.
Once the content pack for vSAN is updated, the new dashboards will show, but not all of the storage policy event widgets will populate. Here are some helpful steps to enable this new capability.
We will need to install a Log Insight Agent on the vCenter Server. First, download the Linux RPM (32-bit/64-bit) via the Log Insight Administration UI, as shown in Figure 4.
Figure 4. Downloading the Linux RPM agent to be installed on vCenter
Next, copy this RPM to a temporary location on your vCenter Server. This can be done using SCP, or WinSCP, assuming SSH has been enabled in the VAMI interface (vcenter-fqdn:5480).
Once uploaded to your VCSA, the agent will need to be installed. Run the following: rpm -i VMware-Log-Insight-Agent-<version-and-build-number>.rpm (adjusting permissions via “chmod” after the files are copied may be required to execute). Once the installation is complete, it can be confirmed in the UI, as shown in Figure 5.
Figure 5. Verification of the agent installation.
Next, configure and enable the vSphere 6.7 – vCenter (Linux) SPBM agent group, as shown in Figure 6. This is what allows Log Insight to capture the SPBM events from vCenter.
Figure 6. Copying the template for the agent group
Once the “Copy Template” button at the bottom of the screen is clicked, it will show the active agent as shown below. One must enter in the IP address of the vCenter server followed by the “Save New Group” button. If the agent group is already in place, the button will show “Save Agent Group” as shown in Figure 7. This step will complete the configuration.
Figure 7. Saving the new agent group
From this point forward, all subsequent events related to storage policies will now be rendered in the dashboard.
How can these new features be used?
The power of tracking policy events can demonstrate itself in several scenarios – including, but not limited to:
- Track sharp changes in capacity utilization in a cluster to see if it was related to unplanned storage policy changes.
- Identify the cause of unsuspecting changes in the performance of a VM.
- Identify causes of resynchronization traffic more easily.
- Track storage policy management beyond the cluster level.
- Use Webhooks to and other tools in Log Insight to potentially report changes to application administrators or owners.
Dashboards need not be complex. I’ve often found that just a couple of otherwise unrelated widgets can be incredibly helpful in providing a simple correlation to other activities occurring in a vSAN cluster. You can find an example of this in the “vRealize Operations and Log Insight in vSAN Environments” guide under, “Using Log Insight to better understand network connectivity issues in vSAN.”
Summary
Log Insight continues its progress forward in performing the difficult, thankless task of scouring log data to provide operational insight. You have the easy task: Upgrading, which is little more than a few clicks away.
Take our vSAN 6.7 Hands-On Lab here, and our vSAN 6.7 Advanced Hands-On Lab here!
