The Log Insight agent leverages agent configurations which can be stored on the Log Insight server or in Content Packs as agent groups. The Log Insight importer leverages manifest files. The question becomes can you convert agent groups into manifests and if so how? In this post, I will answer this question. Read on to learn more!
vSphere Agent Groups
First, you need to start with an existing agent group configuration. Taking the vSphere content pack, you can see multiple agent groups are available:
Assuming the goal is to import a vCenter Server support bundle into Log Insight, we can take the existing agent group as it contains the majority of what we need.
vSphere Manifest
Now that we have an agent configuration, we just need to make one change: convert the absolute path of each directory option to a relative path. Since the Log Insight importer supports recursive directories (more information here), the easiest way to achieve this is to prefix every directory option with a double asterisk. For example, this agent group configuration:
[filelog|vsphere5-linux-vpx]
directory=/var/log/vmware/vpx
include=vpxd.log;vws.log;vmware-vpxd.log
event_marker=^(\[)?\d{4}-\d{2}-\d{2}(T| )\d{2}:\d{2}:\d{2}
parser=vsphere5-linux-vpxd-parser
exclude_fields=date;time;log_message
tags={"vmw_product":"vcenter"}
Would become:
[filelog|vsphere5-linux-vpx]
directory=**/var/log/vmware/vpx
include=vpxd.log;vws.log;vmware-vpxd.log
event_marker=^(\[)?\d{4}-\d{2}-\d{2}(T| )\d{2}:\d{2}:\d{2}
parser=vsphere5-linux-vpxd-parser
exclude_fields=date;time;log_message
tags={"vmw_product":"vcenter"}
IMPORTANT: EVERY directory option within a given agent group needs to be modified. A simple find and replace is sufficient.
Now you can proceed to use the Log Insight importer as previously discussed.
Summary
As you can see, it is easy to convert agent groups into manifest files. All that is required is changing the directory option in every configuration section from an absolute path to a relative.
© 2016, Steve Flanders. All rights reserved.
