One of the greatest features of Log Insight is its notion of content packs. Content packs are free plugins into Log Insight with pre-defined knowledge about specific events (for more information check out this post). Content packs are available from a variety of different locations and Log Insight 2.5 includes a new way that makes installing and updating content packs even easier!
Ships In-Product
By default, Log Insight has always shipped with the vSphere content pack with deep knowledge about vCenter Server and ESXi. Starting with Log Insight 2.0, the product also shipped with the General content pack, which provides information about all events coming into Log Insight.
Solution Exchange
Several additional “official” content packs have been created for Log Insight primarily from VMware and VMware partners. These content packs cover many different aspects of environment monitoring including infrastructure, OS, security, and application. These content pack are all published on VMware Solution Exchange.
Community
The Log Insight community features a content pack section for community developed content packs. Several community content packs have been posted for things like EMC Avamar and VMware NSX as well as analyzing weather data.
Content Pack Marketplace
In Log Insight 2.5, a content pack marketplace has been added natively within the product and is available from the Content Packs page. This provides you with immediate access to content packs without the need of leaving the product or the requirement of signing up/in. In addition, any time you navigate to the content pack page you will quickly see if any updated content packs are available then either selectively upgrade the content packs you want or upgrade all the content packs at once.
NOTE: The marketplace gets populated from the client browser connection not the server-side. This means that the Log Insight instance DOES NOT need access to the Internet.
Summary
Content packs are very powerful because they do most of the log analysis work for you. With the content pack marketplace it is easy to install and update content packs. Be sure to check out all the content pack that are available as a lot have been added after LI 2.0 was released and many more are planned! In my next post, I will cover the enhancements in the in-product content packs.
© 2014, Steve Flanders. All rights reserved.
