Installing vRealize Log Insight 4.5 for vCenter

I went to a VMUG User Conference in August and ran into an old colleague. We started catching up and compared environments. He said I needed to look into VMware vRealize Log Insight. That same day, I went to a session by Paul Woodward, Jr who had Log Insight in his presentation. During Paul’s presentation, he said he uses Log Insight as a quick tool to diagnose issues because any customer with vCenter, has 25 OSI licenses automatically. Who doesn’t like “free” stuff? I took this as a sign. I need to find out more about vRealize Log Insight.

Since version 3.3.2, VMware started to give a taste of Log Insight away to customers who have a valid vCenter license. The name of the product is called VMware vRealize Log Insight for vCenter. This licensed product will allow a customer to stand up one Log Insight appliance and bind it to one vCenter server. If if you have two vCenter licenses, you will need to stand up a second Log Insight appliance. Log Insight for vCenter comes with 25 OSI licenses. These licenses allow you to monitor a range of devices. Those devices can be ESXi hosts, physical servers, VM, or anything else that can run the agent or emits syslogs. This gives you some great flexibility. Perhaps you have have a smaller vSphere environment with a couple of critical VMs. You can monitor your hosts plus those VMs. These licenses are limited in their functionality, but are pretty feature rich. Some high level items missing that a customer might want are HA, Clustering or Custom Content. To get these features, you’ll need to purchase a full Log Insight license.

Below are the steps I took to stand up vRealize Log Insight for vCenter in my lab. You may follow these steps as well. If you like the product, or are missing out on some of the extra features or need to just buy more licenses contact VMware. The purchased licenses will enable these features and you get to keep your 25 licenses.


There are some pre-reqs that must be meet if you’re moving into production. I will not be using this in production. Instead, I want to put this in my lab, so I will not be meeting some of these pre-requisites. I will provide a quick link if you want review them for yourself: here.

Installing vRealize Log Insight

  • Launch vSphere Client, select File > Deploy OVF Template
  • Follow the prompts
  • On the option for Deployment Configuration, select the option that best fits the environment from which vRealize Log Insight for vCenter will be collecting logs. The default of Small is auto-selected and the minimum supported production setup. I changed mine to Extra Small as this will be a lab. Plus, I don’t have an extra 510 GB of storage laying around the house.
    Note: Large deployments require an upgrade to the virtual hardware after deployment.

    Option Log Ingest Rate vCPU Memory
    Extra Small 6 GB/day 2 4 GB
    Small 30 GB/day 4 8 GB
    Medium 75 GB/day 8 16 GB
    Large 225 GB/day 16 32 GB

    My deployment configuration:

  • On the Disk Format page, select a disk format. Thick Provisioned Lazy Zeroed is the default selection. This is a lab so I selected Thin Provision.
  • (Optional) On the Network Mapping, select the desired Destination Networks.
  • (Optional) On the Properties page, if you do not provide network settings like IP address, DNS address, and gateway. Log Insight will use DHCP to set those settings.
    • I like to use an IPAM and statically assign IP addresses for appliances. In my lab, I went ahead and configured all necessary network information.
    • On the Properties page, you can also set the root password near the bottom of the page. If you missed this option, you can use Remote Console once the vm is powered on and configure the password. root/{blank} are the default credentials.
  • Follow the prompts to complete the deployment. After you power on the virtual appliance, an initialization process begins. The initialization process takes several minutes to complete. At the end of the process, the virtual appliance restarts. This fooled me…be patient.(Automate) If you want to know how to deploy by command line, check out

Setup vRealize Log Insight

Now that our virtual machine is happy and is up and running, it’s now time to start the setup. This is where we’ll configure Log Insight to communicate with our vCenter. Here we go!

  • Use your favorite web browser and navigate to the IP address given in previous steps. Mine would be
  • When you hit the page for the first time, it will “Welcome” you (thank you) and prompt you to click Next.
  • Click START NEW DEPLOYMENTThis took some time…again…be patient.
  • Set the password for the admin account and click SAVE AND CONTINUE.
    (Optional) Email of the admin account.
  • On the License page enter in the license key. Click Add License. Next, click SAVE AND CONTINUE.According to this VMware KB2144909, you can use your existing vCenter 6.x or 5.x license key to monitor 25 hosts.
  • On the General Configuration page, put in the email address of those who will need to receive notifications. Click SAVE AND CONTINUE.(Optional) Keep the selected option to Join the VMware Customer Experience Improvement Program if you would like to participate.
  • One the Time Configuration page, enter in your internal NTP time servers. Some NTP servers are given. Click Test to confirm communication. Click SAVE AND CONTINUE.
  • To enable outgoing email, configuration this page. Click SAVE AND CONTINUE.


Ready to Ingest Some Data

Before you can have vRealize Log Insight for vCenter collect alarms, events and tasks you need to configure it to pull this information from your vSphere environment.

vRealize Log Insight can collect two types of data from vCenter Server and ESXi hosts.

  • Select Configure vSphere Integration from vSphere Integration.
  • Type the IP address and credentials for a vCenter Server, and click Test Connection.Note: It is recommended that you use a service account. This is a lab. I’m breaking the law and using administrator.
  • Click SAVE.

Final Thoughts

Once Log Insights is configured, it starts pulling log files from the end points. Any past log files are not collected, only new log files that are generated. The UI looks modern and easy to navigate. The interactive dashboard is a little intimidating, but fast. I believe in certain environments the “free” version will be all they need.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.