Basic log parsing setup for VMware

[mikefg]

There are a lot of pieces to the VMware App, but I am only interested in parsing logs for now. What pieces do I need to just do basic syslog parsing for vCenter and ESXi? Splunk_TA_esxilogs and Splunk_TA_vcenter?

[mikefg · Accepted solution]

In answering my own question - this can be accomplished, but the results aren't great.

I used the Splunk_TA_vcenter, Splunk_TA_esxilog, TA-VMW-FieldExtractions, and SA-VMWIndex pieces of the app. Where these are installed and configured will depend on your splunk environment setup, so I won't get into that here.

The esxi logs are okay, I can see web logins and ssh logins, but the fields aren't all extracted for every event so most of the information I'm looking is usually scattered in different fields.

The vcenter logs are less than okay, but after doing a little more reading this may be more of an issue with VMware than anything e.g. 127.0.0.1 for a login event ip address.