Security logs from VMware

[rschutt]

What is best practice to get VMware security logs into Splunk. They will not be send with Syslog but are only accessable from the console.

[jimodonald]

Splunk is working on a new VMware app which may or may not take that into account (I have no knowledge of what is in the app other than it is a work in progress.)

If you have a good programmer arond, they can write a program to follow the logs in the API and output them to Splunk. See the book VMware VI and vSphere SDK from Steve Jin for reference. Steve's blog, doublecloud.org, provides some information that may help also.

Jim