More discussions in Log & Event ManagerWhere is this place located?
1 Reply Latest reply: Feb 20, 2012 2:25 PM by nicole pauls RSS

vMA vilogger log file collection

dpeach1
dpeach1 Jan 13, 2012 6:29 AM
Currently Being Moderated

I have a vMA collecting syslog files from an ESXi host in my cluster.  rather than try to install the LEM Linux agent on the vmkernel of the ESXi host, I installed it on the vMA that is alreasdy configured to collect the default ESXi logs.  The vMA is reporting to the LEM Manager.  I have created two ESXi tools, one for messages.log and one for vpxa.log and I modified the path to the correct location in the vMA (/var/log/vmware/<hostname>/.  The tools were built off of the ESXi Messages Log and ESXi vmkernal log Tool templates.  I started both tools and created a filter to monitor them. 

I am getting no alerts although the logs are spooling information on the host.  I know the filter works because I get alerted when I stop and restart the agent on the vMA host, but nothing from the logs defined in the tools.  can someone explain where I have gone wrong?

Thanks,

Denis Peach

  • Re: vMA vilogger log file collection
    nicole pauls
    nicole pauls Feb 20, 2012 2:25 PM (in response to dpeach1)
    Currently Being Moderated

    Hey Denis,

    The tools for ESXi messages/vmkernel that are natively built in to LEM are built for receiving the data from syslog to LEM directly, since you can't install an agent on ESXi as you found. I'd recommend sending the ESXi data via syslog to LEM and see if you can get that working first. The right tools to configure are the two tools labeled ESXi (vmkernel and messages) to their default log locations, then the regular ESX hostd tool to /var/log/local4.log.

    Configuring syslog on ESXi: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1016621

    If you build your own tools, chances are they are conflicting with  the existing LEM tools, since we aren't really set up for customer-built  tools and there are some key "keywords" that are probably causing your  tools to not function. If that's not it, it's probably a matter of  matching the right data in the right ways - there's some internals to  the way the tools match data that isn't self-explanatory.

    HTH!

Actions

More Like This

  • Retrieving data ...