From VMware Solutions Exchange site you can download the EMC VNX Content Pack for vRealize Log Insight. This is a very good convenience to the users of both products. Unfortunately, along with this extension has not been published documentation describing the configuration on VNX side. Searching the Internet I not found the information in a consistent manner that shows how to configure the EMC VNX array to send logs to a central syslog (which is the Log Insight). For VNX File it’s not big problem, the controller is managed by the Linux system and simply redirect your logs. However, in the case of EMC Block, there is a rare case when the controllers are working under Windows control for which there is no access. In this case, we need to have a proxy server with installed  Unisphere Host Agent. In this post I will explain step by step configuration of all components, starting by installing the Unisphere Agent.

The installation file of Unisphere Host Agent can be downloaded from the EMC Support for any operating system (Linux, AIX, Solaris, Windows). The agent logs to the storage, retrieves events and writes them to the log on which system is installed (in Unix is /var/log messages in Windows this is the Application log). During installation, the agent will be asked to enter the IP addresses of the two controllers (SP).

Check the agent.config file created during installation. Windows Installer creates entries starting with “User” and the correct value is “user”:

I decided to use the Windows agent, in this case, an additional step is required. We need to get (vRealize Log Insight -> Administration -> Agents) and install the agent who will send logs from Windows to our vRealize Log Insight. You do not need to configure anything, the agent will automatically send the Application log to vRealize Log Insight.

Remember, that such a scheme takes us one license (OSI) in the Log Insight. At this point, we can go to Unisphere and configure remote logging. Go to the “System -> Monitoring and Alerts -> Notification for Block”. We’ll start with the preparation of the corresponding template (which is what we will log):

Go to the “Centralized Monitors” and add “Portal”. Portal within the meaning of the EMC is a system that intermediary collecting logs from both SP. This may be VNX File (Cellerra) if we have it, or Unisphere Central. Due to the weight that can generate a login event, the preferred method is external system (Unisphere Central).

I chose the NAS because its low load in my environment.

In the next step, add the Event Monitor.

Event Monitor is nothing like our Unisphere Host Agent, we can provide the IP address or subnet scan given. We have connected more than one agent.

This is the correct configuration:

In the next step, click on the “System Monitor” and choose our Portal (a little weird) and connect to the pre-defined profile (Use Template):

At this stage, we are all set.

At this point, we can check if the logs are properly taken (as you can see in the picture below, everything works as intended):

Now we can go to vRealize Log Insight and install (from the marketplace or manually) EMC VNX Content Pack and watch what happens in our VNX:

Logs from the storage appear in vRealize Log Insight.