WilliamLam.com

Project USB to SDDC - Part 1

by // 2 Comments

A couple of weeks back, Alan Renouf and I co-presented at the Sydney and Melbourne VMUG UserCon, here are some great write-ups about the events here and here. We were very honored to have been invited out and to also deliever the closing keynote. Having traveled halfway around the world, we thought it was only fitting to share something really special.

For the last couple of months, we had been working on a small pet project that I personally had been referring to as the "vGhetto SDDC". This was not something we had not shared with anyone before and thought the VMUG UserCon was the perfect venue to demo our new project. For the session, we decided to rename the project/session to USB to SDDC (better ring than the previous title) which might give you a hint on what the project might be about.

The inception for this project really stemmed from the work we did at last years VMworld Hackathon which was another idea that both Alan and I had came up and worked with the VMware Code team to deliver at both VMworld US and Europe. Like all great Automation stories, the motivation for this project was born out of pure laziness. With the huge success of the Hackathon at VMworld US, there was a huge demand for us to also deliver it again at VMworld Europe.

[Read more...]

How to forward other VCSA 6.5 logs to remote syslog server?

by // 6 Comments

As mentioned in my previous article (which I strongly recommend you review before continuing further), the VCSA 6.5 no longer uses syslog-ng as the syslog client and it has been replaced with rsyslog. This means the instructions outlined in my old article here is no longer valid on forwarding logs from a VCSA 6.5 system to a remote syslog server. Luckily, the process to forward logs within VCSA 6.5 is also pretty straight forward using rsyslog.

Disclaimer: This is not officially supported by VMware, please use at your own risk. For very large environments, forwarding additional logs can potentially impact the vCenter Server service, so please take caution in the logs you decide on forwarding and test in a lab environment before applying this across your environment.

To help provide a concrete example, I will be using a real world scenario that often comes up from customers on auditing failed vSphere Web Client login success/failures as well as SSO user creation, deletion and password changes. The following two log files provides us with this information which we will forward to our syslog server:

  • /var/log/vmware/sso/ssoAdminServer.log - Auditing SSO logins
  • /var/log/vmware/sso/vmware-identity-sts.log - Auditing SSO user changes

We will be making using of rsyslog Text File Input Module (imfile) which will allow us to process local log files in the VCSA.

[Read more...]

What logs do I get when I enable syslog in VCSA 6.5?

by // 17 Comments

The native remote syslog functionality in the vCenter Server Appliance (VCSA) for vSphere 6.5 introduces several new changes from vSphere 6.0. With some of the questions that I have been receiving on this topic, I figure it would be useful to take a closer look at some of the different behaviors and configuration differences. Hopefully by the end of this article, you will have a better understanding of the syslog capabilities in VCSA 6.5

Remote Syslog Configuration

In VCSA 6.0, to configure the remote syslog configuration, you needed to use the vSphere Web Client. Although this may have felt like a convenience, it also added an unnecessary dependency on both vCenter Single-Sign On (SSO) and the vSphere Web Client UI. In VCSA 6.5, the remote syslog configurations is now part of the VAMI UI (https://[VCSA]:5480) which is an out-of-band interface that can still function if either SSO or vCenter Server is down. Once you have saved your changes, the syslog client will automatically be restarted for the changes to go into effect. If you wish to disable the remote syslog functionality, simply click on the reset button.


Note: If you decide to use port 1514, I have found that you must use the TLS protocol rather than TCP or else it will not work.

[Read more...]