All Apps and Add-ons

Basic log parsing setup for VMware

mikefg
Communicator

There are a lot of pieces to the VMware App, but I am only interested in parsing logs for now. What pieces do I need to just do basic syslog parsing for vCenter and ESXi? Splunk_TA_esxilogs and Splunk_TA_vcenter?

0 Karma
1 Solution

mikefg
Communicator

In answering my own question - this can be accomplished, but the results aren't great.

I used the Splunk_TA_vcenter, Splunk_TA_esxilog, TA-VMW-FieldExtractions, and SA-VMWIndex pieces of the app. Where these are installed and configured will depend on your splunk environment setup, so I won't get into that here.

The esxi logs are okay, I can see web logins and ssh logins, but the fields aren't all extracted for every event so most of the information I'm looking is usually scattered in different fields.

The vcenter logs are less than okay, but after doing a little more reading this may be more of an issue with VMware than anything e.g. 127.0.0.1 for a login event ip address.

View solution in original post

0 Karma

mikefg
Communicator

In answering my own question - this can be accomplished, but the results aren't great.

I used the Splunk_TA_vcenter, Splunk_TA_esxilog, TA-VMW-FieldExtractions, and SA-VMWIndex pieces of the app. Where these are installed and configured will depend on your splunk environment setup, so I won't get into that here.

The esxi logs are okay, I can see web logins and ssh logins, but the fields aren't all extracted for every event so most of the information I'm looking is usually scattered in different fields.

The vcenter logs are less than okay, but after doing a little more reading this may be more of an issue with VMware than anything e.g. 127.0.0.1 for a login event ip address.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...