I’m working a bit with VMware Log Insight Manager for the first time, so I wanted to provide people with a taste of this product.  People don’t tend to know about Log Insight Manager, so hopefully this might ease your worries about it.  It is a pretty easy to use product.  If you’re not familiar with this product, Log Insight Manager is a syslog and event log aggregator and analyzer from VMware that helps to parse, analyze, and alert based on queries.

Installing Content Packs into Log Insight Manager

Content packs are the rule sets of what to look for in syslogs that Log Insight Manager is ingesting.  You can make your own.  You can also install content packs from the marketplace as well.  Finally, you can manually import them.

Installing from Marketplace

Installing from the marketplace is easy.  Just click the settings bar in the top right, click Content Packs, and you’ll be taken to the marketplace (in red).

Unfortunately, this customer has locked down internet access.  I don’t have time at the moment to show how easy this is.  Basically, you can install the content packs right out of this portal, and you’re off to the races.

Importing a Content Pack

This is also very easy.  First off, you would download the Content Pack file.  Once into the Content Packs portion of the web interface, click “Import Content Pack” in the bottom left (in green box).

Browse to the content pack file you downloaded, and select if this should be installed as a content pack, or your own content space.  In this case, I’m installing VMware’s NSX content pack, so I selected “Install as content pack”.  Click import.

Content packs often give you further instructions.  In this case, the NSX content pack gave instructions to point all NSX components for syslogging to Log Insight Manager.

You should then see the Content Pack listed under Installed Content Packs.

And there you have it!