Getting Data In

Adding vCenter logs into Splunk

dbutch1976
Explorer

Hello,

We have most of our environment reporting into Splunk. This includes ESXi hosts, vCenter, Exchange 2007 and several other servers. Currently we only have the Windows Logs (System, Application, Security) reporting in. An example of our inputs.conf file on our vCenter is below:

[default]
host = vCenter

[WinEventLog:Application]
disabled=0
index=windows

[WinEventLog:Security]
disabled=0
index=windows

[WinEventLog:System]
disabled=0
index=windows

On this host I would like to start monitoring all the vCenter logs on this host and I believe I can accomplish this by simply monifying the inputs.conf file. The log files I want to monitor are all located here:

%ALLUSERSPROFILE%\VMware\VMware VirtualCenter\Logs\

These log file names appear to be non-standard and subject to change. Example: (vpxd-15979.log). Is it possible to monitor the entire folder for changes? I have searched for a KB article detailing how to set this up but have come up emtpy, I doubt that I am the first person to try this.

Thanks.

Tags (3)
0 Karma
1 Solution

farleymike
Explorer

I'm not familiar with vCenter logs, but to monitor all .log file in a directory you could add the following to the inputs.conf file:

[monitor://c:\path\to\vcenter\logs\*.log]
index = vcenter
sourcetype = vcenter

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Editinputs.conf

You may also want to check out the new app for VMware. I got a quick demo last week by our Splunk rep and was really impressed.

View solution in original post

farleymike
Explorer

I'm not familiar with vCenter logs, but to monitor all .log file in a directory you could add the following to the inputs.conf file:

[monitor://c:\path\to\vcenter\logs\*.log]
index = vcenter
sourcetype = vcenter

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Editinputs.conf

You may also want to check out the new app for VMware. I got a quick demo last week by our Splunk rep and was really impressed.

piebob
Splunk Employee
Splunk Employee

in the future, if an answer solves your problem, please accept it by checking the checkbox (i did it this time :))

0 Karma

dbutch1976
Explorer

That's got it working, thank you very much!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...