VMware vRealize Log Insight 201
We have vRealize Log Insight (vRLI) installed and configured. We've explored the Administration tab in great detail, where do we go from here? I suggest Dashboards! As in vRealize Operations (vROps), Dashboards are a powerful way to visualize data in vRLI. We'll start with the Dashboards tab at the top and work our way down the left hand pane.
The default dashboard is Overview under the General section. this is where you're taken after clicking Dashboards tab at the top. Here you have the ability to expand the scope of logs from the last five minutes to 48 hours or a custom period of time. Below the time drop down you have three filters, to be used for hostname, source, or app name filtering.
The widgets below the filtering dialogue are grouped by row to show total events, error events, exception events, and warning events. This gives the user visibility into the ESXi Hosts generating the most events in their vSphere environment. Each widget has icons to jump directly to the Interactive Analysis tab, clone the widget, or view information about it.
It's important to note that vRLI Dashboards are quite different from vROps Dashboards. In vRLI you create dashboards by cloning existing ones or creating from scratch via the Interactive Analysis tab, which we will explore in detail in a subsequent blog.
The Problems dashboard shows the number of events by source at the top via a bar chart. Below that are detailed widgets showing unique error event types by type and by trend. This gives the user visibility into general event trends.
The Event Types dashboard gives the user details about their event types..
Statistics provides the user with an inventory of their environment: ESXi Hosts, vCenters, event types, agents, and more.
The Log Insight Agents dashboard provides insight into vRLI Agent generated events: events over time, number of vRLI agents, Windows event viewer events, and more.
Syslog Agents show all syslog agent counts, data, events, and more.
The VMware - vROps 6.7+ dashboards provide visibility into vROps generated events and logs, including vROps Cluster details, individual vROps node details, security information, and user activity.
The VMware - vSAN dashboards provide visibility into your vSAN generated events and logs.
The VMware - vSphere dashboards provide visibility into your vSphere generated events and logs.
There are two more groups of Dashboards: Custom Dashboards and Content Pack Dashboards. Custom Dashboards includes My Dashboards and Shared Dashboards. My Dashboards shows all dashboards you've created. Shared Dashboards shows all dashboards that have been shared with you by others.
Content Pack Dashboards shows all dashboards that have been installed as part of a vRLI Content Pack. We will explore these (and more) in more detail in our next blog.