Comparing the vRealize Log Insight vSphere Integration and vCenter Server Syslog

Products

• VMware Aria Suite

Issue/Introduction

vCenter Server generates the following time series data:

• Events
• Alarms
• Tasks
• Log messages (ie. vpxd.log and other files).

vRealize Log Insight (vRLI) is capable of ingesting this information using various methods. The purpose of this article is to compare what happens when using the vRLI vSphere Integration feature and native vCenter Server Syslog feature to ingest vCenter Server logs within vRLI.

Environment

VMware vRealize Log Insight 4.0.x

Resolution

The following is the comparison between both methods:

 

1. vRealize Log Insight (vRLI) vSphere Integration:
   
   
   1. Initial configuration is done using the vRLI user interface and affects vCenter Server and all ESXi hosts managed by the specified vCenter Server.
   2. Events, Tasks, and Alarm records are pulled from vCenter Server using the vSphere API and are imported by vRLI.
   3. ESXi hosts managed by the vCenter Server instance are optionally configured using the vSphere API to push log messages to vRLI using the Syslog protocol.
   4. The vSphere Content Pack was designed with Events, Tasks, and Alarms to stored using the vSphere Integration method.
      
      
2. vCenter Server Syslog:
   
   
   1. Initial configuration is done using the vCenter Server Virtual Appliance Management Interface and affects the vCenter Server only (ESXi hosts must be configured individually or in groups using features such as Host Profiles).
   2. Events, Tasks, and Alarms are pushed to vRLI using the Syslog protocol.
   3. The vSphere content pack does not support the vCenter Server Syslog method. For more information, refer to the vSphere Content Pack instructions.

It is possible to use both methods to send log messages and time-series data to vRLI. Using multiple methods may result in duplicate information being stored within vRLI.