Getting Started with the Free Log Insight for vCenter

li-logoVMware gives away a 25-OSI pack of vRealize Log Insight 3.3 for all users with a supported vCenter Server license. VMware vRealize Log Insight is a log management software with intuitive dashboards, sophisticated analytics and broad third-party extensibility. It provides deep operational visibility and faster troubleshooting.

Log Insight is not a new product. I’ve already written about it during the beta phase and the final product was introduced back in 2013. With the release of vSphere 6.0 Update 2, VMware has included a 25-OSI package to all vCenter installations allowing all customers to use the product in small environments for free.

In this post I am goging to explain how to obtain the 25-OSI pack and deploy Log Insight for vCenter.

VMware vRealize Log Insight 3.3.1 for vCenter Server is available as virtual appliances. The download has been added to the vSphere 6.0 section, but there is no difference to the “VMware vRealize Log Insight 3.3.1” package, available in the vRealize section.

Download vSphere 6.0

Log Insight 3.3 for vCenter Server will accept any vCenter Server 6.0 Standard, Enterprise, or Enterprise Plus license. For vCenter Server 5.x users, a license key can be found on the Log Insight 3.3 for vCenter Server download page:

Use the Deploy OVF Template function to install the Appliance:
The extra small configuration supports up to 20 ESXi hosts. To take full advantage of the 25-OSI package, and generally for production, the small configuration is recommended. The largest deployment supports up to 1500 ESXi hosts (15,000 events/second). There is no need to make a final decition here. The appliances can be extended later.  
After finishing the deployment wizard, wait a couple of minutes until the Appliances has finised initial configuration tasks. The appliances is available when the following screen is visible in the console:

To configure VMware Log Insight, open a browser and navigate to the URL mentioned in the console and select Next > Start New Deployment

Add a License key. You can either use your vCenter Server 6.0 License key, or the key provided at the Log Insight download page.

Log Insight is now ready to collect logs. The following sources can be configured:

  • vSphere Integration, collects data from vCenter Server and ESXi hosts
  • Agents installed on Linux or Windows systems
  • Syslog Server

To add your vSphere Environment to Log Insight, open Configure vSphere integration »

Add your vCenter Server:

This will automatically configure the vCenter Server, and all ESXi hosts to send their logs to the appliance. You can verify the state, and add/remove ESXi hosts on the detail page:log-insight-vcenter-detail

Logfiles are now ready to be analysed. I’ve deployed 2 ESXi hosts with a vCenter Server, so there are still 22 free licenses left to add more ESXi hosts, or other systems.log-insight-dashboard

VMware Log Insight is not limited to VMware products. It’s intended as central logging system. It is shipped with the following agents:

  • VMware vRealize Log Insight 3.3.1 – Window agent
  • VMware vRealize Log Insight 3.3.1 – Linux agent 32/64-bit (RPM)
  • VMware vRealize Log Insight 3.3.1 – Linux agent 32/64-bit (Debian)
  • VMware vRealize Log Insight 3.3.1 – Linux agent 32/64-bit (binary)

I’m installing the Linux Agent on a Debian based Ubuntu 14.04.4 LTS.

root@aztec:~# dpkg -i VMware-Log-Insight-Agent_3.3.1-3636434.deb
Vorbereitung zum Entpacken von VMware-Log-Insight-Agent_3.3.1-3636434.deb ...
Entpacken von vmware-log-insight-agent (3.3.1-3636434) ...
vmware-log-insight-agent (3.3.1-3636434) wird eingerichtet ...
Starting VMware Log Insight Agent: *

Installation completed.

ATTENTION: Please edit configuration file:

For online documentation please visit:
Trigger für ureadahead (0.100.0-16) werden verarbeitet ...
ureadahead will be reprofiled on next reboot

The Agent needs to know the address of the Log Insight server. Any further configuration can then be done from the Log Insight Management console. Edit the configuration file /etc/liagent.ini and set the hostname to your Log Insight server.

The Linux host should now appear in the Agent Configuration.log-insight-agent-configuration

Groups can be created to deploy the same configuration on a large number of hosts. I’ve created a group for Linux Hosts and added the gathering of /var/log/syslog:

I’ve also added the Log Insight Server as Syslog server on my router. Very nice and quick solution for small networks. But what is the outstanding feature of VMware vSphere Log Insight? Content Packs!

VMware vSphere Log Insight is not just a log aggregator, it also has a deep understanding of log entries, allowing administrators to find quick solutions for problems. Here are some examples from the VMware vSphere Content pack, which is available by default:vsphere-content-pack

Content packs are available from many 3rd party vendors:

Leave a comment ?


  1. Hi,

    When I login to download 3.3.1 Log Insight from my company’s account I donot see the license as you have shown, so I guess I should be taking to VMware Helpdesk about it?

    We have vCenter 5.5 in our environment.


  2. Why is this not available for Essentials Plus licensees??

  3. Hi,
    using this as syslog for your router did affect the number of OSI utilized?
    Is there a limit for storage / daily log amount?

    Thank you.

    • Yes, of course. Any “device” that is delivering to the appliance requires a license. If you add ESXi hosts, they are actually using the appliance as Syslog Server.
      In terms of licensing, there are no storage / daily log amount limitation.

  4. @ Vaibhav: You would not download using your logged in account. Instead use this “group” URL:

    The license is available from the “Read More” link found beneath the File Type on left side of page.

    Final note: VMware Support stated to me that the License Key obtained via this method is Only “Valid for 60 days.” Oddly, when installing the license key, it shows as a permanent license … contrary to what VMware Support stated.

  5. Thanks for sharing the details

  6. I was almost to the stage of pulling my hair out, if I had any left, since the login http page would not come up on the appliance. Finally I walked away and took a coffee break.

    20 minutes later when I came back I tried again and presto. Just a tip to be patient.

  7. Newsletter: March 26, 2016 | Notes from MWhite - pingback on March 26, 2016 at 11:55 pm
  8. “Free Log Insight for vCenter” cant use “3rd party content packs”…. so the last part of the post is not useful.

    also a big tear in my eyes.. as the content packs for
    VNX and ExtremIO are the reason for me to try this appliance…. ;(

  9. Please help, when i try to deply de .pak for vrealize i got this erro: PAK Manager: PAK file VMware-vRealize-Log-Insight-3.3.1-3644329.pak is not in zip format

    someone has a solution ?

  10. How to you add vCenter with port numner other than 443 ?

  11. Can we use Tags to pass a port number ?

Leave a Comment

NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Trackbacks and Pingbacks: