Zsoldier's Tech Blog

I've posted about OpBot in the past w/ a brief overview on how you can setup and deploy.  It's a very cool and immensely useful tool.  However, I must balance this with security.  Responsibly deployed, it can be a very useful tool.  However, there is a dark side to this from a security management perspective.  It also poses the very real risk for allowing generic internet access from within your datacenter. First off, OpBot from Opvizor makes it very clear that you should only grant it's integration account read-only access.  You can do 'destructive' PowerCLI commands by passing login info via slack, but also not recommended.  As much as they have created an immensely useful tool, it also is somewhat of a pandora's box.  It's brought to light a security hole that can be difficult to secure at scale.  Currently Opvizor is the only one that I know of that makes this type of appliance, but that doesn't stop the many possible clones of thi...

Summary: This appears to occur under very specific circumstances. There is a KB and it is also noted Log Insight's troubleshooting section of their documentation. Rather than regurgitate all the same information is here is the gist: Occurs when log insight services are restarted Affects ESXi 5.0.x/5.1.x when using TCP and 5.0 U1 and earlier over UDP. Does not affect 5.0 U2 and newer when using UDP. Here is the table: Communication Protocol Affected ESXi Version TCP ESXi 5.0.x ESXi 5.1.x UDP ESXi 5.0 and 5.0 U1

We unfortunately did not demo the vCOPs integration w/ Log Insight.  I did record those videos though so I figure I would share them here.  No audio, but just videos. Here we are demonstrating the 'context' awareness menu where you can select an object in vCOPs, in this case a VM, and jump into Log Insight w/ a pre-populated query.  It's only context aware from the aspect of object selection, meaning, the VM and the host it's running on, but imagine the integration possibilities. This second video just shows how you can make custom queries and just by aspect of those entries showing up, send an associated alarm to vCOPs for tracking/notification purposes.  The video shows you the idea of finding 'cloned vm' entries and having log insight insert those as a specific type of alert in vCOPs.  The video is poorly edited and is meant to show you the 'concept': Anyway, feel free to post comments here.  I'm always monitoring and willing to answe...

My coworker Mike Regan and I submitted a session for VMWorld and we were accepted.  Our session is scheduled for Tuesday August 27th @ 11:30am.  Bring your lunch and see us demonstrate how we use vCOPs and Log Insight in our daily lives. Unfortunately Mike won't be able to make it, so my other coworker, Jason Davis, will be taking his place. We'll try to keep you entertained, but if you need to throw-up in the middle of our session, please step outside to do so.

vCenter Log Insight is a new log aggregator from VMware. As a new tool that is integrated with vCenter Operations Manager, Log Insight has great potential. The ability to tie in directly with VMware's knowledge base, vCenter and vCenter Operations gives Log Insight a true strength in combining analytics with logging. We started using Log Insight (project Strata) at Tech Preview 2. We had a need for log aggregation solution and thought we'd give it a try on our lower environments. We have used it for different purposes. 1st time was with analytics. when we deployed it, I had setup a dashboard to see "warning" level alerts. 3 of our 120 hosts were far surpassing the others in errors.  After clicking down into the bar graphs we saw a high number of Active Directory related errors.  After rejoining 2 of those hosts to the domain the errors had cleared. The third box we needed to reinstall to clear the errors. Since we've done this all the servers have ...