What's new in log insight 3.3 presentation

1. © 2014 VMware Inc. All rights reserved.
What’s New in VMware® vRealize™
Log Insight™ 3.3
Bill Roth
Product Marketing Manager
Karl Fultz
Technical Marketing Manager
9/13/2016

2. Automation
Service Catalog
Governance
Release Automation
Operations
Service Health
Capacity Optimization
Configuration Standards
IT Business
Cost Transparency
Benchmarking
Service Quality
VMware Cloud Management
2
Compute
Physical
Hardware
Private
Clouds
Public
Clouds
Hybrid Cloud
VMware &
vCloud Datacenter Partners
Virtualized Infrastructure
Abstract & Pool
Compute Abstraction
= Server Virtualization
Storage
Storage Abstraction =
Software-Defined
Storage
Network
Network Abstraction
= Virtual Networking
Applications Modern SaaSTraditional
The Control Plane for the Software-Defined Data Center and the Hybrid Cloud

3. Today’s Reality in Operations Management
3
Monitoring Data Overload Alert Storms
Finger Pointing
DBA
VI Storage
Over-provisioning

4. Silo-ed Operations
Management with
no single solution
Downtime and
Performance
Degradation
• Unified operations solution
across virtual, physical, storage,
network and apps
• Quality of service
• Guided remediation with
accelerated root cause analysis
Key Challenges For Customers
Cost Cutting and
Reduced Budgets
1
2
3
• Optimal utilization of existing IT
assets
• Greater operational efficiency
What do Customers Need?

5. What Could You Do If You Had Insight?
5
Solve problems
faster—
from days to hours
vRealize™
Log
Insight™
Find problems you
didn’t know you had
Get actionable
insight into what
it means

6. Logs as Last Mile to Root Cause Analysis
6
SCSI Errors
NFS Errors
vMotion Failures
Host Disconnects
Dropped Packets
Failed Tasks
Slow Host Syncs
Slow DB Queries

7. vRealize Log Insight 3.3

8. • Log Insight for vCenter Edition
• Integrated Load Balancer Capabilities
• Multiple VIPs with Associated Tags
• Enhanced vSphere Integration
• Alert Option – Webhooks
• UI Enhancements
• View Chart Data as Table
• Authentication and Simple Query APIs
• LTSV, Regex, and Syslog Agent Parsers
• IPv6 Support
• Additional Features
• Log Importer
• Agent Configuration – Preview
vRealize Log Insight 3.3
What’s New

9. vRealize Log Insight for vCenter
vRealize Log Insight
Available with vCenter Server Standard
Intelligent Log Analytics for vCenter
• Free 25-OSI Log Insight pack per vCenter
Benefits of vRealize Log Insight for vCenter
• Powerful big data log management built for vSphere
• Includes all VMware Content Packs
• Extensive Log Management – Captures log data from
physical servers, network and storage devices, OSs,
applications, and more
• Intuitive on-the-fly keyword filtering and custom
dashboards
• Integration with vRealize Operations – Inventory
integration, 2-way Alert Visualization
NEW
The best real-time
management for SDDC
Security
A
p
p
Operating
System
vSphere
System
Statistics
Applications Other IT
A
p
p
Logs
Upgrade to Full vRealize Log Insight for:
• Extensibility – 3rd Party and Custom Content Packs such
as Microsoft, Cisco, EMC, NetApp (29+ available)
• Scalability – Cluster Support and Event Forwarding
• High availability, Archiving and SSL

10. Integrated Load Balancer – Multiple VIP
10
Define
multiple VIPs
with ILB
Associate tags with
each VIP. Useful for
RBAC and Content
Packs
ILB Election
process is
unchanged

11. vSphere Integration Enhancements
11
Add tags for vCenter
and ESXi events.
RBAC use case
Automatically add
unconfigured
Hosts
Choose ILB VIP

12. Alert Enhancement - Webhooks
12
Send alerts
using HTTP
POST
Point to external
URLs, i.e. vRO,
SocialCast,
ServiceNow

13. View Chart Data as a Table
13
Build data
visualizations
using a table
Choose Table to
change the
visualization•

14. Authentication API
• Use-case: Required to leverage the query API (discussed next)
14
Request Response
GET /api/v1/sessions HTTP/1.1
Host: localhost:9543
Accept: application/json
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
{
"userId": ”<user_guid>",
"ttl": <int>
}
POST /api/v1/sessions HTTP/1.1
Host: localhost:9543
Accept: application/json
Content-Type: application/json
{
”provider”: “<Local|ActiveDirectory>”,
"username": ”<username>",
"password": ”<password>"
}
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
{
"userId": ”<user_guid>",
"sessionId": ”<session_id>",
"ttl": <int>
}

15. Simple Query API
• Use-case: Used to programmatically query for data in Log Insight
15
Request Response
GET /api/v1/events/timestamp/%3E10
HTTP/1.1
Host: localhost:9543
Accept: application/json
Authorization: Bearer <session_id>
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
{ "complete": true,
"events": [ {
"fields": [
{ "content": "172.16.127.1", "name": "hostname" },
{ "content": "v4_e0cb4506", "name": "event_type" },
{ "content": "172.16.127.1", "name": "source" }
],
"text": "this is a test event",
"timestamp": 1449771888082
} ] }
GET /api/v1/aggregated-events/<value>
HTTP/1.1
Host: localhost:9543
Accept: application/json
Content-Type: application/json
Authorization: Bearer <session_id>
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
{ "complete": true,
"events": [ {
…

16. New Client-Side Agent Parsers
• Labeled Tab-Separated Values (LTSV) format is a variant of Tab-
Separated Values (TSV)
• Syslog parser automatically parses timestamp from the beginning of
the log and extracts application name as filed with name "appname".
• Regex based on boost::regex
16
LTSV Syslog Regex
[filelog|simple_logs]
directory=/var/log
include=*
parser=ltsv
[filelog|simple_logs]
directory=/var/log
include=*
parser=syslog
[filelog|simple_logs]
directory=/var/log
include=*
parser=regex_parser
[parser|regex_parser]
base_parser=regex
format=(?<tag1>d{4})[-](?<tag2>d{4})[-](?<tag3>d{4})

17. Additional Features
• Copytruncate Support
– Creates a copy of a log file then truncates the original log file.
• Additional OVF options
– DNS searchpath and DNS domain
– Allows hostname only name resolution.
• New Importer Utility
– Windows or Linux command-line tool used for importing offline or archived
logs to the Log Insight server.
• Agent support for Windows 10
• Hybrid License
• Agent Configuration Builder (Tech Preview)
– Streamlines the build and validation of agent configurations.
• Virtual Appliance IPv6 support (Tech Preview)

18. Learn More
Try the Hands-on Lab.
Nothing to download!
20
Visit the website for
resources, 60-day free trial,
evaluation guide, and
purchasing information.
@VMLogInsight
www.vmware.com/products/vrealize-log-insight
vmware.com/go/vRealize-Ops-Insight-HOL
loginsight.vmware.com/
Website:
Hands-on Lab:
Log Insight Community:

19. Thank You
Questions?
Email broth@vmware.com