This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Import VMWare ESX syslog?

After setting up LEM and configuring syslogs on several devices, I realized about 2 months in that I had not turned on the connector for VMWare syslogs and so said logs were not being recorded. I have now turned them on and we are receiving current syslogs, however, I am able to export syslogs from VCenter and would like to import them into LEM. Does anyone know if this is possible? I realize this may cause some issues with timing of the logs but we aren't that concerned about that, we just need to analyze some of the logs and LEM would make that much easier.

Thanks

  • Hey,

    It may be possible to import your ESX syslogs. You can try this - on a machine that you have the LEM agent installed on, apply the appropriate ESX syslog connector on that agent (via the LEM web console) & point it to an empty file (e.g. esx.log). Open the empty file & paste your log contents into it. The connector should then parse those logs.

    As you mentioned, there are some limitations, mainly the fact that the data will be searched & reported based on Detection Time & the time on the appliance, but the Insertion Time value (original log version) will be collected and shown. The data won't be useful against your rules as it will be too old.

    If you are comfortable with sending me a log sample of the exported syslogs, I can then test the above suggestion in my lab & let you know the outcome.

  • jhynds​ method should work.  Alternatively, Support can root into your appliance and dump the raw logs into LEM via the syslog facilities.  One note, though: DETECTION TIME is the original time-stamp on the event.  INSERTION TIME is when the event was written into the LEM database.  Your Detection Times will reflect when things actually happened, and the Insertion Times will be "the present" or whenever the logs get pushed into the LEM.