{"id":380,"date":"2020-07-31T11:54:43","date_gmt":"2020-07-31T10:54:43","guid":{"rendered":"http:\/\/thomas-kopton.de\/vblog\/?p=380"},"modified":"2020-08-15T20:05:36","modified_gmt":"2020-08-15T19:05:36","slug":"vrealize-operations-and-logging-via-cfapi-and-syslog","status":"publish","type":"post","link":"https:\/\/thomas-kopton.de\/vblog\/?p=380","title":{"rendered":"vRealize Operations and Logging via CFAPI and Syslog"},"content":{"rendered":"\n

Without any doubt configuring vRealize Operations<\/span><\/strong> to send log messages to a vRealize Log Insight<\/strong> <\/span>instance is the best way to collect, parse and display structured and structured log information<\/strong>.<\/p>\n\n\n\n

In this post I will explain the major <\/span>differences between CFAPI and Syslog<\/span><\/strong> as the protocol used to forward log messages to a log server like vRealize Log Insight.<\/span><\/p>\n\n\n\n

The configuration of the log forwarding in vRealize Operations is straight forward. Under “Administration” –> “Management” –> “Log Forwarding” you will find all options to quickly configure vRLI as target for the selected log files.<\/p>\n\n\n\n

The following figure shows how to configure vRealize Operations to send all log messages to vRealize Log Insight using the CFAPI protocol <\/strong>via HTTP.<\/p>\n\n\n\n

\"\"<\/a>
Figure 1: Log Forwarding configuration<\/figcaption><\/figure>\n\n\n\n

The CFAPI<\/strong> protocol, over HTTP or HTTPS, used by the vRealize Log Insight agent provides additional information used by the vROps Content Pack. The extracted information flows into the various dashboards and alert definitions delivered through the Content Pack. Following picture shows one of the available dashboards populated with available data when using CFAPI and vRLI.<\/p>\n\n\n\n

\"\"<\/a>
Figure 02: vROps Content Pack<\/figcaption><\/figure>\n\n\n\n

In case you (for whatever strange reason) cannot use CFAPI, you can configure vROps to use Syslog. It is as simple as selecting Syslog as the protocol option in the configuration page shown in the following picture.<\/span><\/p>\n\n\n\n

\"\"<\/a>
Figure 03: Syslog as configured protocol<\/figcaption><\/figure>\n\n\n\n

The drawback of using Syslog here is that the additional information parsed by the agent and used by the content pack will no longer be available and you will need to create your own extracted fields in vRLI to parse data from the log messages.<\/p>\n\n\n\n

In the next both pictures you can see the empty dashboards and log messages without any vROps specific fields in the interactive analytics .<\/p>\n\n\n\n

\"\"<\/a>
Figure 04: Empty dashboards when using Syslog<\/figcaption><\/figure>\n\n\n\n
\"\"<\/a>
Figure 05: Missing vROps specific fields when using Syslog<\/figcaption><\/figure>\n\n\n\n

It is important to know that vROps is using Syslog over TCP<\/span> <\/strong>when configured via UI as shown in figure 03.<\/p>\n\n\n\n

But what if you are forced to use Syslog over UDP<\/span><\/strong>?<\/p>\n\n\n\n

There is no such option in the UI but since vROps is using the regular vRLI agent, there has to be a way to configure it to use UDP instead of TCP.<\/p>\n\n\n\n

The vRLI config file explains how to set the according option:<\/p>\n\n\n\n

\"\"<\/a>
Figure 06: liagent.ini config file<\/figcaption><\/figure>\n\n\n\n

You can just replace<\/p>\n\n\n\n

proto = syslog<\/span><\/strong><\/pre>\n\n\n\n
with<\/p>\n\n\n\n
proto = syslog_udp<\/strong><\/span><\/pre>\n\n\n\n
restart the agent<\/p>\n\n\n\n
service liagentd restart<\/strong><\/span><\/pre>\n\n\n\n
and your vROps nodes starts to forward log messages to your log server using UDP.<\/p>\n\n\n\n
I have setup a fake log server listening on 514 UDP using netcat:<\/p>\n\n\n\n
\"\"<\/a>
Figure 07: Syslog over UDP in NC<\/figcaption><\/figure>\n\n\n\n
If you configure the vRLI agent in vROps directly via the config file, please keep in mind:<\/span><\/p>\n\n\n\n