As I covered in the past, Log can be licensed per OSI or CPU. If you are using OSI licensing for ESXi then you may notice the same hosts are counted more than once. In this post, I will cover how to fix this issue. Read on to learn more!
For Log Insight, an OSI is the originator of an event. Per the syslog RFC, the originator of an event is indicated by the hostname field within the event. In the case of ESXi, sometimes events from the same host are sent with different hostname fields. If any originator of an event sends more than one hostname then Log Insight will count the originator more than once. For ESXi, setting the hostname can address this issue. You could do this in a variety of ways including via host profiles or through the vSphere API. Here is an example of how to do it from the CLI:
# esxcli system hostname set --fqdn=<fqdn>
Once the hostname is set properly, the OSI count will deprecate over time as the old hostname is rotated out of the check.
IMPORTANT: This workaround is specific to ESXi. Some systems (e.g Horizon View) do not have such an option.
© 2017, Steve Flanders. All rights reserved.