In the July release of vRealize Log Insight Cloud support for VMware Azure VMware Solution (AVS), log sources were released. In this blog, I describe the procedure to forward logs from AVS SDDC
What is VMware Azure VMware Solution (AVS)
Azure VMware Solution (AVS) provides you with private clouds that contain vSphere clusters built from dedicated bare-metal Azure infrastructure. All provisioned private clouds have vCenter Server, vSAN, vSphere, and NSX-T. For more details, you can refer to the official documentation
Logs from Azure VMware Solution (AVS) are now available in vRealize Log Insight Cloud
Audit Use Cases
- vCenter and ESXi Hosts Audit Logs for security compliance
- Virtual Machine Logs for vMotion tracking
Diagnostic Use Cases
- NSX-T firewall packet logs to troubleshoot firewall misconfigurations during migration, new workload rollouts, and day 2 operations.
- Filtering and forwarding logs for centralized Data lake or SIEM solutions for threat prevention, threat detection, incident management, and machine learning.
Options
To configure AVS to send logs to vRealize Log Insight Cloud, use either of the following methods:
- Event Hub – It is a fully managed, real-time data ingestion service. It can stream millions of events per second from any source to build dynamic data pipelines
- Storage Account(Blob Storage) – It is an object storage solution for the Azure cloud. We will be using it to save the NSG flow logs. You can use an existing account however I will be demonstrating how to create one as well
adsa
Notes –
- In both the options the Azure Function needs to be deployed in the same Azure subscription where AVS SDDC is deployed. It will mean there will be an additional cost for the same.
- Each option has its own quotas & limits. Please refer Azure documentation for the same
What is the vRLI Cloud Azure function?
vRLI Cloud Azure Function – It creates an Azure function using a custom ARM Template that fetches logs from Event Hub or Blob Storage and forwards them to vRealize Log Insight Cloud. It has been open-sourced. For more details, you can refer to the github-repo. I will be demonstrating how to deploy this as part of this blog
Procedure
The following section includes step-by-step instructions to enable log forwarding of AVS SDDC to vRealize Log Insight Cloud via Event Hub
Step 1 – Create an Event Hub
Navigate to instructions under log source on how to create Event Hub.
https://www.mgmt.cloud.vmware.com/li/sources/details?id=eventhub
If you want to use an existing Event then you will need to use ARM template under Map an Event Hub. There are some additional configs to be done. This blog doesn’t cover that.
Step 2 – Configure diagnostic settings for AVS SDDC
From your Azure VMware Solution private cloud, select Diagnostic settings, then Add diagnostic settings.
In the Diagnostic setting, under Destination details,
- Select the vmwaresyslog
- Select Stream to an Event Hub
From the Event Hub namespace drop-down menu, choose where you want to send the logs, select, and Save.
Step 3 – Azure Event Hub Trigger to fetch logs from Event Hub
The Eventhub trigger starts a vRealize Log Insight Cloud function when an event is sent to an event hub event stream.
Navigate to the Functions section under the Functions tab of vRealize Log Insight Cloud Function (Name should start with \” VMwareLogsFunction\”) and click eventHubFunction
Click the Integration tab under the Developer section and then click Azure Event Hub Trigger to edit the trigger details
Step 4 Verify Logs in vRealize LogInsight Cloud
If everything is successful you can search for logs using
event_provider contains AZURE_AVS
Related Articles