Log Insight User Alerts from the VCOPS User

In my last post, I covered the new user alerts administration page in Log Insight 4.0. On that page, you may have noticed alerts from the mysterious VCOPS_* user. In this post, I would like to explain why the VCOPS_* user may exist and why you should not modify alerts from that user. Read on to learn more!

Solution Integration

In the past, I covered the integration available between Log Insight and vRealize Operations Manager. There is actually one additional integration that exists that I have not covered before: solution integration. In short, vROps management packs support the ability to install and configure Log Insight content packs. This solution integration is at the discretion of the management pack author. To date, only one management pack takes advantage of this integration: NSX-vSphere.

Enabling Solution Integration

In order for solution integration to work, some prerequisites must be met:

1. Integration configured between Log Insight and vROps
2. Installation of a vROps management that supports solution integration (e.g. NSX-vSphere)
3. Enabling Log Insight integration within management pack configuration (if applicable)

Step #3 can be seen as the “Enable Log Insight integration if configured” option on the NSX-vSphere management pack configuration page:

Solution Integration Benefits

So what do you get as part of solution integration?

1. Installation of the associated content pack into Log Insight (e.g. NSX-v) privately
2. Enabling selective content pack alerts to send to vROps automatically
3. Configuration of devices to log to Log Insight (e.g. NSX manager, controller, edges)

Note: #3 is dependent on whether the solution supports such configuration and if the management pack author enabled the functionality.

How Solution Integration Works

As you may know, content packs installation is possible either globally or via an import into user space. Content pack alerts are always copied into user space (in Log Insight 4.0, you can subscribe to content pack alerts, but the result is still a copy into user space — more information in a future post). Given that a user is needed to enable alerts, solution integration creates a user of the following format: VCOPS_<vropsHostname>. Solution integration then imports the associated content pack into the solution integration user’s private space. The net result is that the associated content pack and alert integration are for the most part transparent to Log Insight users.

Other Solution Integration Information

There is only one way within Log Insight to confirm solution integration: user alerts administration page:

Note: You will not even see the user on the Access Control page.

You should not edit solution integration alerts on the user alerts administration page. If you no longer want solution integration, you should disable the integration on the vROps management pack configuration page.

Note: Any changes made to solution integration within Log Insight will get overridden.

Like most best practices, there are exceptions. The one exception to editing solution integration alerts is if you receive a duplicate user alert system notification about solution integration. While this is a corner case, which should not happen, if you do see it, you should:

1. Remove integration from the vROps management pack
2. Go to the user alerts administration page on LI and remove any remaining alerts from the VCOPS_* user
3. Re-enable integration from the vROps management pack

© 2017, Steve Flanders. All rights reserved.