The files that contain system messages are on the vRealize Log Insight virtual appliance.
The following table lists each file and its purpose.
If you need information on log rotation or log archiving for these files, see Log Rotation Schemes Supported by vRealize Log Insight Agents in Working with vRealize Log Insight Agents and Data Archiving in Administering vRealize Log Insight.
| File | Description |
|---|---|
| /var/log/vmware/loginsight/alert.log | Used to track information about user-defined alerts that have been triggered. |
| /var/log/vmware/loginsight/apache-tomcat/logs/*.log | Used to track events from the Apache Tomcat server. |
| /var/log/vmware/loginsight/cassandra.log | Used to track cluster configuration storage and replication in Apache Cassandra. |
| /var/log/vmware/loginsight/plugins/vsphere/li-vsphere.log | Used to trace events related to integration with vSphere Web Client. |
| /var/log/vmware/loginsight/loginsight_daemon_stdout.log | Used for the standard output of vRealize Log Insight daemon. |
| /var/log/vmware/loginsight/phonehome.log | Used to track information about trace data collection sent to VMware (if enabled). |
| /var/log/vmware/loginsight/pi.log | Used to track database start or stop events. |
| /var/log/vmware/loginsight/runtime.log | Used to track all run time information related to vRealize Log Insight. |
| /var/log/firstboot/stratavm.log | Used to track the events that occur at first boot and configuration of the vRealize Log Insight virtual appliance. |
| /var/log/vmware/loginsight/systemalert.log | Used to track information about system notifications that vRealize Log Insight sends. Each alert is listed as a JSON entry. |
| /var/log/vmware/loginsight/systemalert_worker.log | Used to track information about system notifications that a vRealize Log Insight worker node sends. Each alert is listed as a JSON entry. |
| /var/log/vmware/loginsight/ui.log | Used to track events related to the vRealize Log Insight user interface. |
| /var/log/vmware/loginsight/ui_runtime.log | Used to track runtime events related to the vRealize Log Insight user interface. |
| /var/log/vmware/loginsight/upgrade.log | Used to track events that occur during a vRealize Log Insight upgrade. |
| /var/log/vmware/loginsight/usage.log | Used to track all queries. |
| /var/log/vmware/loginsight/vrops_integration.log | Used to track events related to the vRealize Operations integration. |
| /var/log/vmware/loginsight/watchdog_log* | Used to track the run time events of the watch dog process, which is responsible for restarting vRealize Log Insight if it is shut down for some reason. |
| /var/log/vmware/loginsight/api_audit.log | Used to track the API calls to Log Insight. |
| /var/log/vmware/loginsight/pattern_matcher.log | Used to track the pattern matching times and timeouts for field extraction. |
| /var/log/vmware/loginsight/audit.log | Used to track how vRealize Log Insight is used. For more information, see Audit Logs in vRealize Log Insight. |
Log Messages Related to Security
The ui_runtime.log file contains user audit log messages in the following format.
- [2019-05-10 11:28:29.709+0000] ["https-jsse-nio-443-exec-9"/10.153.234.136 DEBUG] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User login success: vIDM: SAM=myusername, Domain=vmware.com, [email protected]]
- [2019-05-10 11:28:45.812+0000] ["https-jsse-nio-443-exec-3"/10.153.234.136 INFO] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User logged out: vIDM: SAM=myusername, Domain=vmware.com, [email protected]]
- [2019-05-10 11:28:29.709+0000] ["https-jsse-nio-443-exec-9"/10.153.234.136 DEBUG] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User login success: Active Directory User: SAM=myusername, Domain=vmware.com,[email protected]]
- [2019-05-10 11:28:45.812+0000] ["https-jsse-nio-443-exec-3"/10.153.234.136 INFO] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User logged out: Active Directory User: SAM=myusername, Domain=vmware.com,[email protected]]
- [2019-05-10 11:29:28.330+0000] ["https-jsse-nio-443-exec-6"/10.153.234.136 DEBUG] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User login success: Local User: Name=myusername]
- [2019-05-10 11:29:47.078+0000] ["https-jsse-nio-443-exec-10"/10.153.234.136 INFO] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User logged out: Local User: Name=myusername]
- [2019-05-10 11:29:23.559+0000] ["https-jsse-nio-443-exec-7"/10.153.234.136 WARN] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User login failure: Bad username/password attempt (username: incorrectUser)]
- [2019-05-10 11:45:37.795+0000] ["https-jsse-nio-443-exec-7"/10.153.234.136 INFO] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Created new user: Local User: Name=myusername]
- [2019-05-10 11:09:50.493+0000] ["https-jsse-nio-443-exec-6"/10.153.234.136 INFO] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Created new user: vIDM: SAM=myusername, Domain=vmware.com, [email protected]]
- [2019-05-10 11:47:05.202+0000] ["https-jsse-nio-443-exec-10"/10.153.234.136 INFO] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Created new group: (directoryType= VIDM, domain=vmware.com, group=vidm_admin)]
- [2019-05-10 11:58:11.902+0000] ["https-jsse-nio-443-exec-4"/10.153.234.136 INFO] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Removed groups: [class com.vmware.loginsight.database.dao.RBACADGroupDO<vidm/vmware.com/vidm_admin>]]
Some logs are available in debug level. For information about enabling the debug level for each node, see Enable Debug Level for User Audit Log Messages.
Tip: If you are an administrator, you can modify the logging level without restarting the
vRealize Log Insight service. Go to http://
<your_Log_Insight_host>/internal/config, update the value of the logging level for the relevant logs, and click
Save. For example:
<self-logging>
<logger name="root" level="INFO" />
</self-logging>
You can change the logging level to OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE, or ALL.
Note: Each node in a
vRealize Log Insight cluster has its own
ui_runtime.log file. You can examine the log files of the nodes to monitor the cluster.
