VMware vRealize Log Insight is a product I have been quite fond of since it first came out–I liked it for a variety of reasons–one is the simplicity of use. As far as VMware’s entire management suite, it is the easiest to install/configure and understand how to use. You can really become an accomplished user in a day. Anyways, I finally got around to updating the Pure Storage FlashArray Content Pack to expand support for version 2.5 and also leverage some new functionality from Purity syslog messages.
What’s new?
I’ve added:
- Seven more dashboard widgets
- Seven additional extracted queries
- One more alert
- Two additional custom queries
The majority of the updates come by leveraging some new visualizations in the dashboards which, I think, makes the information much easier to quickly digest than it was before. As far as the actual information, the updates focused around better auditing messages and more information concerning replication. In Purity 4.1 we added a lot more auditing information to our syslog output, like for instance invalid login attempts and access methods. I’ve also added a widget on protection groups that have been delayed and a new alert that can tell you when changes have occurred to protection schedules. Here are some examples of the new dashboards (I’ve excluded hardware because it hasn’t changed):
Overview:
FlashRecover:
Auditing:
Also, one of the cool new features of Log Insight 2.5 is the ability to edit the dashboard widgets in-place. This saves a lot of time when you want to make a change to the underlying query–this also makes the content packs (once imported into user space) much easier to alter if you so choose.
You now do not have to go to the Solution Exchange to get the Content Packs, you can download them from right inside Log Insight in the Marketplace listing:
Of course you can still download it from the Solution Exchange if you want. If you would like to review the white paper I wrote you can check it out here:
Support information:
- VMware vRealize Log Insight 2.5
- FlashArray 400 Series
- Purity 4.x. Some of the new auditing information in 4.1 is leveraged though, so if you are not running Purity 4.1 or later, some of the Auditing dashboards widgets will not populate. We still support this content pack with 4.0 though.
Check out a video demonstration of it here:
I ran into an issue with the content pack on the following extracted fields because a user account that was connecting had a hyphen.
pure_setattr_operations
pure_volume_name
pure_volume_operations
I exported the pack and modified the regex for the fields as shown below. (I also had to make a similar correction in the widgets to get them to display properly.)
Original:
“preContext”:”purity\\.audit: \\[\\w+\\]
New:
“preContext”:”purity\\.audit: \\[\\V+\\]