Configure vRealize Log Insight 4.x to Ingest runtime.log

Products

• VMware Aria Suite

Issue/Introduction

The purpose of the article is to provide the correct configuration for Log Insight 4.x to be able to allow the ingestion of the runtime.log logs.

Note: It is not supported for Log Insight to ingest it's own runtime.log, the logs must be sent to a different Log Insight cluster or node.

Environment

VMware vRealize Log Insight 4.6.x
VMware vRealize Log Insight 4.3.x
VMware vRealize Log Insight 4.7.x
VMware vRealize Log Insight 4.x
VMware vRealize Log Insight 4.8.x
VMware vRealize Log Insight 4.5.x

Resolution

vRealize Log Insight is not able to ingest it's own runtime.log files, so a second receiving vRealize Log Insight instance must exist or be setup. 

vRealize Log Insight comes with a pre-installed Agent.
To make sure it's installed, run rpm -qa | grep VMware-Log-Insight-Agent in command line.
If no results appear, please download and install the corresponding LI Agent.

Once a receiving vRealize Log Insight instance is designated, configure it to receive the runtime.log files of the sending instance.

1. Log into the receiving vRealize Log Insight UI as an administrator.
2. Navigate to Administration > Agents.
3. Choose or create an Agent group at the top if desired.
4. Under Agent Configuration, click Edit.
5. Create the below Agent configuration. Adjust the values as needed for your environment.

Note: There are two options for configuring the filelog|runtime-log section. Users either need to add the configuration into the liagent.ini file or configure an agent group.
 

--------- Agent Config ----------
[server]
hostname=fqdn or IP 
proto=cfapi
port=9000 # or 9543
ssl=no # or yes accordingly
 

[filelog|runtime-log]
directory=/storage/var/loginsight
include=runtime.log;runtime.log.*
event_marker=\[\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}\+\d{4}\]
---------- End Config ----------

Note: The event marker is a regular expression that denotes the start of an event in the log file.

6. Click Save Configuration.