Windows vCenter Log forwarding to VMware Log Intelligence using Fluentd

I co-authored the blog where we displayed how to install fluentd and send logs to VMware Log Intelligence (Click Here) however we did that for Linux which covers most of the scenarios however in this blog I will walk through fluentd installation on Windows where I have vCenter installed as an Application

Steps

In following section I will walk through how to install fluentd on windows 2012 R2 which has vCenter 6.5 installed

Install td-agent

You can download the \”.msi\” file from here, and install the software

After you\’ve installed .msi package, you\’ll see the program called Td-agent Command Prompt installed. Please double click this icon in the Windows menu and execute following command

fluentd -c etc\\td-agent\\td-agent.conf

Please launch another Td-agent Command Prompt and type the command below

echo {\”message\”:\”hello\”} | fluent-cat debug.event

It\’s working properly if td-agent process outputs the message

Register Run td-agent as Windows Service

Please execute Td-agent Command Prompt again but with administrative privilege, and type the two commands below.

fluentd –reg-winsvc i
fluentd –reg-winsvc-fluentdopt \’-c C:/opt/td-agent/etc/td-agent/td-agent.conf -o C:/opt/td-agent/td-agent.log\’

You will now be able to see \”Fluentd Windows Service\” as one of the services installed

Right Click and start the service. By default, the Startup Type is Manual you can change it to Automatic if needed

You should see log file being created at \”C:/opt/td-agent/td-agent.log\”

Install plugins

We will need to install HTTP Output plugin additionally to send logs directly to VMware Log Intelligence.

Please execute following command in Td-agent Command Prompt

fluent-gem install fluent-plugin-out-http-ext

Configure td-agent.conf with Windows vCenter Details

Default location for vCenter vpxd logs is \”C:\\ProgramData\\VMware\\vCenterServer\\logs\\vmware-vpx\”

We will need a pos file. I have created the file in the same location as vpxd to keep it simple. Please ensure it has appropriate permissions

Modify the default td-agent.conf which is located at \”C:\\opt\\td-agent\\etc\\td-agent.conf\” by replacing it will following configuration.

https://github.com/munishpalmakhija/fluentd/blob/master/td-agent-windows.conf

Please note you will need to generate your own API key for your org as mentioned in my blog here

Restart the \”Fluentd Windows Service\” for the new config to be used

If everything goes well you should be able to view logs by filtering out hostname contains windowsvcenter

References

https://docs.fluentd.org/v1.0/articles/install-by-msi
https://cloud.vmware.com/community/2018/07/10/using-fluentd-send-logs-cloud-vmware-log-intelligence/