As you know, Log Insight supports integration with vSphere. One part of the integration is the collection of vCenter Server events, tasks and alarms. If you are using a non-English vCenter Server locale and you wish to leverage the Log Insight vSphere content pack, read on!
Credit: Thanks to my colleague Tomas Baublys for putting together this information!
Update: A new KB was released with an even better approach!
Log Insight
In Log Insight 2.5, Localization and Internalization of the Log Insight UI was introduced. This feature did not apply to events received by Log Insight and the requirement to date is that events should be sent to Log Insight in English. Now the Log Insight agent supports three character sets today:
- UTF-8
- UTF-16LE
- UFT-16BE
This of course means the Log Insight server supports these three character sets as well.
vCenter Server
In the case of vCenter Server, changing the locale also changes the language in which some log messages are written. For example, let’s assume you are using the German locale on vCenter Server and you integrated with Log Insight. The result would be log messages that look like the following:
As you can see, Log Insight displays the events as expected. Also note that the locale settings on Log Insight have no impact on the way in which events are displayed in Log Insight as discussed earlier. Now, let’s go look at the vSphere content pack and specifically the dashboards applicable to vCenter Server and the previous log message:
Wait, why do we have no results? We just saw that events were being received. Let’s view one of these dashboard queries on Interactive Analytics. We will look at vCenter Server logins by type:
A-ha! This query requires English keywords (“logged in”) in order to match events, but our events are in German. This confirms that events must be ingested in English especially if you wish to leverage existing content packs today. Now, you could make a content pack for German events, but that is outside the scope of this post. Instead, let me cover how you would change the locale of vCenter Server so events are received in English.
The good news is VMware already has a KB article for this issue and recently released and even better KB article — use the second link. After following these instructions events should start coming into Log Insight in English automatically. You can then confirm that the vSphere content pack is working as you expected:
Summary
- Log Insight can consume logs in a variety of character sets
- While Log Insight 2.5 offers Localization and Internationalization this does not apply to events or content packs
- Content packs require that events be received in English
- For vSphere integration, the vCenter Server locale can be changed by following this KB
© 2015, Steve Flanders. All rights reserved.
