The approach to setting up ESXI syslogging to LogInsight is very much covered in many other places. But how about vCenter Appliance logging. Of course you can use the vCenter syslog option but this has limitation that some of the LI vSphere content packs will not work correctly, so the key is to install the agent on the appliance (this includes the PSC if it has been installed externally). This blog will cover vCenter 6 installed as an appliance with Log Insight 3.3.6.
Download and Install the Agent on the VCSA
To do download the agent log into Log Insight and under Administration>Agents, scroll to the bottom of the page and click on the Download Log Insight Agent Version 3.6.0 link at the bottom of the page. Choose the RPM download.
Copy this onto the VCSA, I normally use WinSCP for this task. You need to ensure that shell access is enabled see this link for more details on how to achieve this for WinSCP copying.
Copy the file into to /tmp directory. Once copied over access the VCSA via putty. The we need to run the installer. As you can see as we downloader the installer from the LI Install it already has contained the IP address of the LI server.
#rpm -i VMware-Log-Insight-Agent-VERSION-BUILD_NUMBER.rpm
VCSA Agent Configuration
Once the agent has been installed it will appear in the Agent list in Log Insight (Administration>Agents)
Now it needs to be configured with an agent group. Pull down the All Agents drop down list and hover the vCenter 6.x – vCenter (Linux) Essential template, and on the two overlapping squares at the end of the line, click on copy template to create a new agent group for this server
Create the new Agent Group giving it a new name. Note we are using the essential configuration, which gives a balance of a good level of logging against ingestion of logs. If more complete logging is required, maybe when troubleshooting an issue, complete logging can be applied.
Now the Agent group can be assigned to the agent, use the filter option to setup the agent to the IP address of the VCSA deployed.
Then save the changes (Scroll to the bottom of the pager and select Save New Group)
It may take up to 30 minutes for data to start to filter through to LI, as the agent on the VCSA only pulls new configuration details every 30 minutes.
This process can be completed for the PSC if it is external also, and the same agent group can be used.