General Log Insight Q&A

Bug - Content pack loading after uninstall

Hi

 

After uninstalling a content pack. Log Insight still tries to access the last used content pack, which in this case has been uninstalled. This results in Log Insight loading "forever" - Atleast i did not see it timeout.

 

Workaround close all browsers and log in again.

Submitted by (@michaelryom)
Add your comment

Voting

1 vote

Content Packs

Veeam B&R Content Pack Agent configuration incomplete

Veeam has issued a content pack for their popular product Veeam Backup & Replication with several dashboards and field extractions.

Still, Agent has no configuration and does not collect Veeam events.

 

Simple as it is, it could be useful to have Agent configuration ready here:

 

[winlog|Veeam_Backup]

channel=Veeam Backup

 

Yes, that's it :)

 

Should I really attach it as a separate content pack here?

Submitted by (@o.karimov)
4 comments

Voting

1 vote

Administration of Log Insight

Forwarding windows events (UDP/TCP) always includes tags

I am forwarding windows events collected by LI agent from Log Insight to Splunk using syslog protocol. , The box "Forward complementary tags" is not checked, but it seems to be always on. On the receiver side I see following additional stuff in the event: - - - [Originator@6876 eventid="326" task="General" keywords="Classic" level="Information" channel="Application" eventrecordid="2018" providername="ESENT"] Complementary ...more »

Submitted by (@tomas.baublys)
Add your comment

Voting

1 vote

Feature Requests

NSX CP - Edge Firewall action Field does not work

The Extracted Field in NCX CP Version 3.6 does not work with NSX 6.3.1. I have not tested other Versions of NSX or CP.

Submitted by (@markus.kraus)
Add your comment

Voting

1 vote

Feature Requests

Log Insights Alerting Add Fields

We use Log Insights to alert for Windows Event Log entries. It would be very helpful if we could select additional fields from the entries to include in the alerting.

Submitted by (@zentrout)
1 comment

Voting

3 votes

Feature Requests

vRO plug-in for Log Insight

It would be extremely helpful to have a vRO plug-in for vRLI that contains prebuilt workflows for common scenarios using the API.

Submitted by (@chipzoller)
2 comments

Voting

3 votes

Feature Requests

User Alerts Should Be Able to Be Added to Shared Content

In the Content Packs section for Log Insight, if you look at the Shared Content, there is a tab for Alerts, but you can't build any shared alerts. It would be really useful to be able to make user level alerts shared with everyone.

Submitted by (@mfriedri)
Add your comment

Voting

3 votes

Feature Requests

Should be able to delete content from Content Packs section

When you go to look at stuff in My Content or Shared Content in the Content Packs view of Log Insight, you can't delete any content you don't want from there. You have to first open up the dashboard, query, extracted field, etc. in either the Dashboards or Interactive Analytics view. This feels like an unnecessary step. You should probably be allowed to delete things directly from the Content Packs view.

Submitted by (@mfriedri)
Add your comment

Voting

3 votes

Feature Requests

Emailed Alerts

When an alert is triggered to send an email, the email has no contents that give details on the event.

 

For instance, we send syslog from Cisco routers and switches. We have an alert setup to show when a configuration change is made. The email shows "someone made a config change." It would be nice to include things that were in the log, username that made the change, the device/source, etc.

Submitted by (@mdrake)
2 comments

Voting

2 votes

Feature Requests

Additional time ranges

Currently there are only some few time ranges possible: 5 minutes, 1h, 1d, 2d and custom. With custom only possible to define a fixed range. It would be nice to have a greater range of options. I love how Graylog is managing that. You can, for instance, define "Since Midnight" and then getting all message... well you guest it... since midnight. Or "Last Week", Today, Last Month ... you get it. For starting it would be ...more »

Submitted by (@rockaut)
1 comment

Voting

1 vote

Feature Requests

high availability of data across workers

I'd looking for more than one copy of each unit of log data in order to survive the loss of individual node, similar to splunk. Maybe this takes the form of shipping closed Cassandra buckets (although that would not provide cover for recently ingested data).

 

Ideally, I could use this to provide support for loss of a worker within an AZ, or even the loss of an entire region.

Submitted by (@nthaler)
3 comments

Voting

3 votes

Administration of Log Insight

Forwarder produce events in the Windows Event XML format

Log Insight's Forwarder supports Syslog and CFAPI (HTTP+JSON) today. The Forwarder should be extended with an additional serialization format, conforming to the Windows Events XML schema. Standard Windows Events' XML attributes should be reconstructed from standard Log Insight field=value pairs.

 

This aligns with http://loginsight.vmware.com/a/idea-v2/211076

Submitted by (@acastonguayvmware.com1)
Add your comment

Voting

1 vote