--- id: vmware title: VMware sidebar_label: VMware description: The Sumo Logic app for VMware collects unified logs and metrics from the VMware cloud computing virtualization platform, including vCenter Server, vSphere, ESX/ESXi, and individual virtual machines, for real-time display in predefined dashboards. slug: /help/docs/integrations/containers-orchestration/vmware/ canonical: https://www.sumologic.com/help/docs/integrations/containers-orchestration/vmware/ --- import useBaseUrl from '@docusaurus/useBaseUrl'; VMware dashboards The VMware app uses unified logs and metrics from the VMware cloud computing virtualization platform to enable monitoring of vCenter, ESXi hosts, and individual virtual machines' metrics with real-time data displayed in predefined dashboards. The dashboards provide insight into key events and metrics such as VM CPU, memory, disk utilization, under-provisioned physical hosts, and idle VMs. This enables you to determine capacity constraints and troubleshoot operational issues related to over-provisioning, changes to configuration, and VM movement. See the [vSphere product page](https://www.vmware.com/products/vsphere.html) for more information on VMware hybrid cloud. ## Prerequisites * **Supported Software Versions**. The VMware app works with vCenter and vSphere 6.5, 6.7, 7.0, and 8.0. * **Sumo Logic scripts for VMware**. The Sumo Logic scripts required to work with the app are located here: [sumo-vsphere-ulm.zip](https://appdevstore.s3.amazonaws.com/VMWare/sumo-vsphere-ulm.zip). ## Log and metric types The Sumo Logic vCenter logs source and vCenter metrics source use the installed collector to gather the following data from VMware: * VMware Events using the Events API. See [Events API](https://developer.broadcom.com/xapis/vsphere-web-services-api/latest/vim.event.EventManager.html) for more details. * VMware Metrics using the Performance API. For more information, see [Performance API](https://developer.broadcom.com/xapis/vsphere-web-services-api/latest/vim.PerformanceManager.html). The dashboards provide real-time monitoring with visual data displays, allowing you to analyze events and performance metrics for efficient detection and troubleshooting. ### Sample log messages ```json 2018-11-15 17:39:09.569 +0530 ,,, message=Error detected for sumo-win2k8-a-4 on xx1.sumolabs.com in Production1-West: Agent cannot send heartbeats.msg size: 612, sendto() returned: Operation not permitted.,,,eventType=,,, vm=ubuntu16.04-b-4,,,host=8df.sumolabs.com,,,datacenter=Production3-East,,, computeResource=esx1.sumolabscluster.com,,,key=3553,,,chainId=3269 ``` ### Sample queries The following query is from the vSphere Errors Trend panel of the vCenter Errors - Analysis Dashboard. ```sumo _sourceCategory = Labs/VMWare6.5 and ("error" or "fail" or "critical") | parse "message=*,,," as err_msg | parse "host=*,,," as esx_host | parse "eventType=*,,," as event_type | parse "vm=*,,," as vm nodrop | parse "computeResource=*,,," as cluster | where esx_host matches {{esx_host}} and cluster matches {{cluster}} and event_type matches {{event_type}} | timeslice 1h | count(err_msg) as err_count by _timeslice | compare with timeshift 1d 7 ``` ## Collecting logs and metrics for the VMware app The VMware app collects logs and metrics from your VMware cloud computing virtualization platform, then displays the data in predefined dashboards. The app enables you to monitor vCenter, ESXi hosts and VM metrics and events. This section provides instructions for collecting logs and metrics for VMware. ### Step 1: Set up a server, host, or VM to collect data You can use the following method for setting up a server to collect data for the VMware app: If you have an existing VM, go directly to [Installing the Sumo Logic scripts on a VM](#installing-sumo-logic-scripts-on-a-vcenter-server-another-host-or-vm) and proceed with following the instructions. Install the Sumo Logic scripts for events and metrics on a vCenter server or another host with access to vCenter APIs. #### Installing Sumo Logic scripts on a vCenter server, another host, or VM This section walks you through the process of installing Sumo Logic scripts for events and metrics on a vCenter server or another host with access to the vCenter API. Lastly, it provides instructions for configuring the path to run the scripts, whether on a vCenter server, host, or VM. To install and configure the Sumo Logic scripts, do the following: 1. On the server, host, or VM, create a directory in which to put the Sumo Logic scripts from [Sumo Logic Scripts](https://github.com/SumoLogic/sumologic-vmware/tree/master/vsphere) for VMware. We recommend that you name the directory **/var/log/vmware* or something similar. 2. Download the Sumo Logic VMware scripts from [here](https://s3.amazonaws.com/appdevstore/VMWare/sumo-vsphere-ulm.zip), into the directory you just created. 3. Install [python](https://www.python.org/) version 3.9, or later. 4. Install libraries required by the Python script by running the following command : ```bash pip install -r requirements.txt ``` :::note You can change the [pyvmomi](https://pypi.org/project/pyvmomi/) version in **requirement.txt** based on the compatible vSphere version from [here](https://github.com/vmware/pyvmomi?tab=readme-ov-file#compatibility-policy). ::: 5. Verify that the user account that will run the Sumo Logic VMware scripts has full read/write/execute permissions for the directories where the scripts will be placed. Without adequate permissions (read/write/execute) for the directories in which the script files reside, unexpected script errors will occur. 6. Edit the **cron_vcenter_events.sh** script, changing the `SCRIPT_PATH` variable to reflect the **absolute path** where the script resides. If you have multiple vCenter servers, create a new line for each one. ### Step 2: Set up the Sumo Logic Installed Collector Our Installed Collector is a Java agent that receives logs and metrics from its Sources and then encrypts, compresses, and sends the data to the Sumo service. The Collector runs as a service and starts automatically after installing or rebooting. See [Installed Collectors](/docs/send-data/installed-collectors) for installation instructions. ### Step 3: Collect logs and metrics for the VMware app This section explains how to set up a vCenter server, host, or VM to collect logs and metrics for the Sumo Logic app for VMware. #### Collecting event messages An event is an action that triggers an event message on a vCenter Server. Event messages are not logged, but are instead stored in the vCenter Server database. The Sumo Logic Collector for VMware retrieves these messages using the vSphere Python SDK. ##### Step 1: Configure logs to be collected Test running a Python script from the directory containing the Sumo Logic scripts. 1. To test the **events.py** script that queries the vCenter Server for events and sends the events to Sumo Logic, go to the directory for the Sumo Logic scripts and run the **events.py** script with one of the following commands.
View examples here for the different source types (click to expand) The sample username format is **username@vsphere.local** or **domain/username**. ```bash python3 events.py -s [vcenterserver] \ -u [username] -p [password] -f output.txt ``` **Example 1: Using a file output, use a local or remote file source in this case.** ```bash python3 $SCRIPT_PATH/events.py -s 192.168.124.29 -t sumologic_host -to sumologic_host_port -u sumoadmin -p sumoadmin -f /var/log/vmware/output/vsphere_events ``` **Example 2: Using syslog and a specific log directory with a specific log file prefix. You can use a syslog source to ingest the logs.** ```bash python3 $SCRIPT_PATH/events.py -s 192.168.124.29 -t sumologic_host -to sumologic_host_port -u sumoadmin -p sumoadmin -l /var/log/vmware/log/vsphere_events ``` **Example 3: Using syslog and a specific log directory with a specific log file prefix and an encrypted Password. You can use a syslog source to ingest the logs.** ```bash python3 $SCRIPT_PATH/events.py -s 192.168.124.29 -t sumologic_host -to sumologic_host_port -u sumoadmin -pK 'xgb8NJ3ZYPJbzX6vWHySZbLd73bKWPsGMKoSnry7hL4=' -p 'gAAAAABb6asvlRfxEj_ZQTKOyrqnGNMbfo_kpxrqv4DCO6TorS4FmKFzrepe0_xtiMT67ZT6OOf5bfrVZXNnUDFNlwPWrpFSfg==' -pE True -l /var/log/vmware/log/vsphere_events ``` By default, the script starts collecting data for the past 24 hours. To retrieve data for a smaller time range, for testing purposes, set the parameter `-bT` to the time from which to start data collection, for example, one hour earlier: ```bash python3 events.py -s -t -to -bT
2. Once you are satisfied with the output, modify the **cron_vcenter_events.sh** with the required parameters and create a cron job to periodically run the **cron_vcenter_events.sh** script at the desired time interval. * If utilizing a syslog source, provide the target and target port parameters where the Sumo Collector is installed. If utilizing a local or remote source, use the file parameter to generate the file and configure the **File Path** for a local file source or **Path Expression** for a Remote file source. * The cron job needs to run as root or as a user who has read and write access to the script directories. * For more detailed information, see the shell script for configuration options. ##### Step 2: Configure a syslog or a file source A [Sumo Logic Syslog Source](/docs/send-data/installed-collectors/sources/syslog-source) operates like a Syslog server listening on the designated port to receive Syslog messages. The script supports syslog server, as well as generating a text file that can be ingested using [Local](/docs/send-data/installed-collectors/sources/local-file-source) or [Remote](/docs/send-data/installed-collectors/sources/remote-file-source) file source. A local file source is recommended as it has several benefits over Syslog, including no need to worry about connection retry, reading from the last pointer in a file, no data loss in the case of collector failure, and so on. Based on your preference, you can configure a syslog source, a local, or a remote file source. For a file source, configure a local or remote file source in one of the following ways: * **If the script and the Sumo Logic collector are on the same server**: configure a local file source by following [these](/docs/send-data/installed-collectors/sources/local-file-source) steps. Configure the **File Path** for the local file source. Set **Path Expression** equivalent to the output directory mentioned in the previous section using `-f` flag (for example: `/var/log/vmware/output/`). * **If the script and the Sumo Logic collector are on different servers**: configure a remote file source by following [these](/docs/send-data/installed-collectors/sources/remote-file-source) steps. Configure the **Path Expression** for the Remote file source. Set **Path Expression** equivalent to the output directory mentioned in the previous section using `-f` flag (for example: `/var/log/vmware/output/`). :::note You can also add a wildcard to the path like /var/log/vmware/output/*evt.out for sending only the script-generated files. ::: * **For a syslog source**, configure the syslog source as follows: 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic main menu select **Data Management**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. 1. Click **Add Source**. 2. Select **Syslog** for the Source type. 3. Enter a **Name** to display for this Source. Source name metadata is stored in a searchable field called `_sourceName`. 4. For **Protocol** choose **TCP**. 5. Enter the correct **Port** number (for your Collector) for the Source to listen to, such as 1514. 6. For **Source Category**, we recommend using **vcenter_events**. 7. Under **Advanced**, set the following options: * Select **Extract timestamp information from log file entries**. * Select **Ignore time zone from log file and instead use** and then choose **UTC** from the menu (as shown below). 8. Click **Save**. #### Collecting performance metrics Collecting performance metrics involves using scripts to call the vCenter performance API’s to extract performance statistics. Performance data collection for ESXi servers associated with a vCenter server works by getting data from each ESXi server in parallel, using multiple threads. The number of threads depends on the amount of data you are collecting and the frequency of the collection. The number of threads can be controlled using the property `THREADSIZE_POOL` in the sumo.json config file. You can also control the number of objects processed by a single thread using the property `BATCH_MORLIST_SIZE`. The following is a description of all the configuration properties. ```txt BATCH_MORLIST_SIZE: Default 50, Simultaneous objects processed by a single thread for retrieving the performance data. THREADSIZE_POOL: Default 5, Number of threads SSL_VERIFY: Default False, if using SSL, set as True SSL_CAPATH: Certificate absolute path if SSL_VERIFY is True ``` To collect performance metrics, do the following: 1. Follow the instructions to configure a [Streaming Metrics Source](/docs/send-data/installed-collectors/sources/streaming-metrics-source). While configuring, set the **Protocol** to **TCP** and **ContentType** to **Carbon2**. 2. Edit the properties in the bundled sumo.json properties file, as necessary. 3. Go to the directory for the Sumo Logic scripts and run the **esx_perf_metrics_6_5.py** script, which queries the vCenter Server for metrics from that location (this script queries the vCenter Server for events) with the following command: ```py python3 esx_perf_metrics_6_5.py -u [username] \ -p [password] -s [vcenter server] \ -t [target server] -to [target port] \ -cf [config filename] ```
View examples (click to expand) **Example 1: Using a metrics streaming source and a specific log directory with a specific log file prefix.** ```py python3 $SCRIPT_PATH/esx_perf_metrics_6_5.py -s 192.168.124.29 -t sumologic_host -to sumologic_host_port -u sumoadmin -p sumoadmin -cf $SCRIPT_PATH/sumo.json -l /var/log/vmware/log/metrics ``` **Example 2: Using specific log directory with a specific log file prefix and encrypted Password.** ```py python3 $SCRIPT_PATH/esx_perf_metrics.py -s 192.168.124.29 -t sumologic_host -to sumologic_host_port -u sumoadmin -cf $SCRIPT_PATH/sumo.json -l /var/log/vmware/log/vsphere_metrics -pK 'xgb8NJ3ZYPJbzX6vWHySZbLd73bKWPsGMKoSnry7hL4=' -p 'gAAAAABb6asvlRfxEj_ZQTKOyrqnGNMbfo_kpxrqv4DCO6TorS4FmKFzrepe0_xtiMT67ZT6OOf5bfrVZXNnUDFNlwPWrpFSfg==' -pE True ``` **The script supports the following parameters:** * `-s`. Remote vCenter Server to connect to. Required Parameter. * `-o`. Remote vCenter Server port to use, default 443. Optional. * `-u`. User name to use when connecting to the vCenter server. Required. * `-p`. Password to use when connecting to the vCenter server. Required. * `-ts`. Timestamp File. Default ‘.timelog_metrics’. * `-t`. The hostname where the Sumo Logic installed collector is installed. Required. * `-to`. Target Sumologic port to use, default 514. Optional. * `-cf`. Configuration File. Required. * `-l`. Log File Prefix. Default: `vsphere_metrics_`. By default, the log file is created in the execution directory. Full log path and log prefix can also be specified, for example: `-l C:\Users\user6\vsphere_metrics`, where `vsphere_metrics` is the log prefix and is required. The log file is created with a prefix + current timestamp. * `-pE`. Is the password encrypted? Default: False. Optional. * `-pK`. Encryption Key for Password. Required if `-pE` is True.
4. In Sumo Logic, verify that metrics are being captured. 5. When you are satisfied with the batch and thread configurations, modify the **cron_vcenter_metrics.sh** with the required parameters and create a cron job to periodically run the **cron_vcenter_metrics.sh** script at the desired time interval. * The cron job needs to be run as root, or as a user who has read and write access to the script directories. * For more detailed information, see the shell script for configuration options. Sample CRON job to periodically run the **cron_vcenter_metrics.sh** script every 15 minutes (use the `sudo crontab -e` option), and add the following line: ```sql */15 * * * * /var/log/vmware/cron_vcenter_metrics.sh ``` #### Collecting historical events By default, the first time **events.py** is called, events from the past 24 hours are collected. Each time the script is called, it writes the timestamp of the last read event in a file named **.timelog_events** for the next call to pick up. To collect events older than the past 24 hours, before setting up the CRON job for **cron_vcenter_events.sh**, run the script as follows: ```bash python3 events.py -s \ -t -to -bT