2 Replies Latest reply on Nov 4, 2016 9:43 AM by curtisi

    Import VMWare ESX syslog?

    beckerj99

      After setting up LEM and configuring syslogs on several devices, I realized about 2 months in that I had not turned on the connector for VMWare syslogs and so said logs were not being recorded. I have now turned them on and we are receiving current syslogs, however, I am able to export syslogs from VCenter and would like to import them into LEM. Does anyone know if this is possible? I realize this may cause some issues with timing of the logs but we aren't that concerned about that, we just need to analyze some of the logs and LEM would make that much easier.

       

      Thanks

        • Re: Import VMWare ESX syslog?
          jhynds

          Hey,

           

          It may be possible to import your ESX syslogs. You can try this - on a machine that you have the LEM agent installed on, apply the appropriate ESX syslog connector on that agent (via the LEM web console) & point it to an empty file (e.g. esx.log). Open the empty file & paste your log contents into it. The connector should then parse those logs.

           

          As you mentioned, there are some limitations, mainly the fact that the data will be searched & reported based on Detection Time & the time on the appliance, but the Insertion Time value (original log version) will be collected and shown. The data won't be useful against your rules as it will be too old.

           

          If you are comfortable with sending me a log sample of the exported syslogs, I can then test the above suggestion in my lab & let you know the outcome.

          • Re: Import VMWare ESX syslog?
            curtisi

            jhynds method should work.  Alternatively, Support can root into your appliance and dump the raw logs into LEM via the syslog facilities.  One note, though: DETECTION TIME is the original time-stamp on the event.  INSERTION TIME is when the event was written into the LEM database.  Your Detection Times will reflect when things actually happened, and the Insertion Times will be "the present" or whenever the logs get pushed into the LEM.