Shipping logs off to a repository for the benefit of troubleshooting, root cause analysis, post mortem reporting and today with AI (Artificial Intelligence) technologies, particular findings and trendings in logs can be proactively shared to an operator.
For the following article will demonstrate integrating vSphere with Aria Operations for Logs and ensuring your hosts get updated to point to your instance. Keep in mind that my instance is deployed as a ‘Small’ which is primarily targeted for POC environments, in an enterprise you should have a minimum of 3 appliance nodes and should have a VIP assigned. I do have ESXi 8.0 installed and have configured vSAN ESA.
From the vSphere console the following advanced setting for a host will shows Syslog.global.logHost is configured with a blank entry. After we are done, this will be populated.
Access your Aria Operations for Logs instance via Virtual IP or single instance name, if you receive the following prompt, this is generally an indication your instance has never been configured.
Click ‘Configure vSphere Integration’
You will be taken to where you can integrate a vCenter instance, (Do not use a local SSO account, create a service account separately)
If we leave the checkbox highlighted in yellow, this is what will be pushed out to configure ESXi hosts send logs to Aria Logs.
When clicking ‘Advanced option’ it will display and allow you to select specific hosts and even a syslog protocol. Just note, you must click ‘Test Connection’ and Accept thumbprint from the vCenter before it can poll hosts.
For our write up, I will only select esxi01 with UDP. Click ‘Save’ and ESXi hosts will be configured in addition to any vCenter logs. Once completed your vSphere Integration will like this. You can click next vSphere for refresh, VC Collection status is healthy and if you click ‘View Details’ it will show hosts configured and not configured in vCenter.
When you go back to the host and check the Advanced Setting, you will now see it populated with Aria Logs instance
If you want to go back and makes changes to what ESXi hosts and collections, you can go back into the vSphere Integration and then have options, in our case, I will come back and configure my 2 other hosts.
By now you should have logs from hosts and vCenter shipped to Aria Operations for Logs.