Installing the Linux Log Insight agent on vCenter Orchestrator

The Log Insight agent now gets pre-installed on some of the vRealize appliances which is very useful which means there is no need to install agents manually.  Some of the VMware products which have the agent pre-installed:

vRealize Business
vRealize Operations Manager (beginning from 6.1)
vRealize Orchestrator (beginning from 7.0.1)
vRealize Automation (beginning from 7.0.1)
vRealize Log Insight

However this version of Orchestrator is 6.0.3 due to work testing so we need to install the agent manually.

vCO Details

• Name = techlabvco001.techlab.local
• IP Address = 192.168.1.123/24
• SSH enabled
• vCO Config Page = https://192.168.1.123:8283
• vCO Getting started page and Orchestrator client download = https://192.168.1.123:8281/vco
• vCO Appliance login = https://192.168.1.123:5480

Log Insight Details

• Name = techlabvrl001.techlab.local
• IP Address = 192.168.1.122/24
• SSH enabled
• Log Insight Configuration = https://192.168.1.122

Useful link to Log Insight Documentation Center

http://pubs.vmware.com/log-insight-30/index.jsp#com.vmware.log-insight.agent.admin.doc/GUID-04892000-72C6-4227-BB37-6A2271E03B8C.html

Steps

Note: You may already have Orchestrator installed. If so go from connecting WinScp to the Orchestrator appliance.

• Download and install the vCenter Orchestrator OVF. In my case this was version 6.0.3 as I was doing some testing for work.
• Import the OVF into vCenter and follow the wizard to set all the relevant configuration information. Note: You will need to set a root password and a default password for the vmware user account in the wizard in order to access the configuration page
• Power on the vCO appliance
• Navigate to the vCO Config Page = https://192.168.1.123:8283 and log in with the account vmware and the password you set during installation
• In the General Page you can reset the vmware account password if you wish

• Click on Network and check all the details are correct

• You will need to put in an authentication source (LDAP, Active Directory etc) This is required as you will need to have authentication sources to log in to the Orchestrator client

• After configuring an authentication source, you may need to restart the vRO Server and the vRO Configuration Server.

• Add your license in. Options are below

• Check all other options and configure as relevant. Basically everything should look green.
• Next Log into Log Insight

• Click on the Administration icon (Top right in Log Insight)

• Click on Agents

• Click on Download Log Insight Agent Version 3.0.1
• Choose Linux RPM

• Using Winscp, log into the vCO appliance

• We now need to copy the Linux Log Insight agent to a directory on the vCO server
• Copy the agent to the /tmp folder

• Putty in to the vCO box
• Switch to the /tmp folder – cd /tmp
• To set the target vRealize Log Insight server during installation run the sudo command and replace hostname with the IP address or hostname of the vRealize Log Insight server.
• sudo SERVERHOST=hostname rpm -i VMware-Log-Insight-Agent-VERSION-BUILD_NUMBER.rpm
• In my case
• sudo SERVERHOST=techlabvrl001.techl;ab.local rpm -i VMware-Log-Insight-Agent-3.0.0-2985111.noarch_192.168.1.122.rpm

• You should see the following

• Go back into WinSCP and open the file liagent.ini from /etc/liagent.ini
• Check the LogInsight hostname has been added in and check all other options. We will not be modifying this liagent file as the recommended way to modify these settings is via the Linux Content Pack which needs to be imported into Log Insight and configured from within here. Instructions below in further steps

• Go back into Log Insight and refresh the page and check the agent has been picked up.

Next we need to install the Linux Content Pack – Linux__v1.0.vlcp currently

• Go to the Administration icon and click on Content Packs

• Find the Linux Content Pack

• When you click on the Content Pack, the below information will come up

• Click Install and the below message will come up

• Now that you have installed the content pack you can create groups with specific configurations. Go back to Administration > Agents and create your first group for Linux computers.
• Select Linux in the pull-down menu and click on the copy template button (2 rectangles). (Note you can’t see the 2 triangles until you hover over the agent)

• Put a name in for the agent group

• Adjust the filter to reflect what machine/machines you want to use
• In this case I have just added a filter for the hostname of my vCO server

• This adds the following to the Agent Configuration for the agent on your Linux machines.
• If you want to view the Orchestrator Workflow Information then you need to add another section in the Agent Configuration (

[filelog|vmw-vco-scripting-lo]
directory=/var/log/vmware/vco/app-server
include=scripting.log
parser=syslog_parser

• Click Save New Group
• Log into the Orchestrator client and test a Workflow (I used Add an Active Directory Server and Remove an Active Directory Server but you could try anything)

• You should then see the below Workflow being logged in log Insight if you filter by vCO hostname

• Voila, you have logging set up for the vCO in Log Insight

Adding queries to Dashboards

• We were using a Workflow which changed VM vDS Port Groups. Within this Workflow, it is set to output a string to the scripting log called PORTGROUP Change – Update completed successfully
• We can create a favourite query using this query text contains PORTGROUP Change – Update completed successfully – See highlighted below
• You can now add this query to a Dashboard. Whilst in the query, you can click on the icon to the right (highlighted in yellow) which means Add current query to dashboard

• Fill in the Dashboard details and then you should be able to view this anytime and adjust the time over which work has taken place