vMA vilogger log file collection

dpeach1

I have a vMA collecting syslog files from an ESXi host in my cluster.  rather than try to install the LEM Linux agent on the vmkernel of the ESXi host, I installed it on the vMA that is alreasdy configured to collect the default ESXi logs.  The vMA is reporting to the LEM Manager.  I have created two ESXi tools, one for messages.log and one for vpxa.log and I modified the path to the correct location in the vMA (/var/log/vmware/<hostname>/.  The tools were built off of the ESXi Messages Log and ESXi vmkernal log Tool templates.  I started both tools and created a filter to monitor them. 

I am getting no alerts although the logs are spooling information on the host.  I know the filter works because I get alerted when I stop and restart the agent on the vMA host, but nothing from the logs defined in the tools.  can someone explain where I have gone wrong?

Thanks,

Denis Peach

FormerMember

Hey Denis,

The tools for ESXi messages/vmkernel that are natively built in to LEM are built for receiving the data from syslog to LEM directly, since you can't install an agent on ESXi as you found. I'd recommend sending the ESXi data via syslog to LEM and see if you can get that working first. The right tools to configure are the two tools labeled ESXi (vmkernel and messages) to their default log locations, then the regular ESX hostd tool to /var/log/local4.log.

Configuring syslog on ESXi: kb.vmware.com/.../search.do

If you build your own tools, chances are they are conflicting with the existing LEM tools, since we aren't really set up for customer-built tools and there are some key "keywords" that are probably causing your tools to not function. If that's not it, it's probably a matter of matching the right data in the right ways - there's some internals to the way the tools match data that isn't self-explanatory.

HTH!