Logging (and keeping) VMware vRealize Log Insight’s ingestion rate

Logging (and keeping) VMware vRealize Log Insight’s ingestion rate

VMware vRealize Log Insight doesn’t give you much on the statistics tab. If you want to know the event ingestion rate for the last week or even the last day you’re out of luck (as far as I could see). Since I’m constantly restarting my vRLI instance I’d like to know these stats!

Doesn't show much between last 15 minutes and last time it was rebooted (could be weeks, right?)

Since the API is available to us I’ve written a quick and dirty bash script to get the ingestion rate. We can send it back to vrli where we can make a dashboard from it. I’m an absolute beginner in bash so I’m sure there are plenty of things that can be done better:

https://github.com/joshsname/LogInsight-IngestionRate

Put this script on some server (not log insight) and pair it with a cronjob that runs every 5 minutes. Make sure the server itself is configured to log to vrli and watch it go. Soon you’ll start seeing the logs come in and then you can make a dashboard from the logs giving you some nice historical data.

VMware vRealize Log Insight's interactive analysis function showing the logs are being received.
vRLI's dashboard with a single widget showing log ingestion for the last 24 hours (not many logs in my lab environment).

I feel like I’m the only one in the world that was missing out this data, so let me know if it helped you. This is my quick and dirty method so I’m sure there’s a tonne of things we could do (hide the password, insert these metrics into vrops, etc…).

This was made in my lab with the following:

  • vRLI 8.1.1
  • Ubuntu Server

References:

https://vmw-loginsight.github.io/#aggregated_events___path_

Leave a Reply

Your email address will not be published. Required fields are marked *