vRealize Log Insight maps predefined vSphere datastore names to device IDs. Because of this mapping, you can use datastore names that are aliases for device IDs in queries. The query finds messages with the datastore name or the device ID for which it is aliased. vRealize Log Insight must receive both the key (datastore name) and its value (datastore ID) in messages before the alias can be enabled.

Aliases are defined in the VMware-vSphere content pack. Aliases can be static or dynamic.

Static Aliases

Static aliases are configured by using the following fields:

Field Description
aliasFields The static mapping of a value to a key for a given searchField.
name The name of the alias field.
searchField The name of the field for which an alias is desired.
value The value of the searchField to match.
key The alias to display with events that contain the searchField.
definition A static alias is defined as:
"aliasFields":[{
    "name":"vmw_esxi_scsi_host_status",
    "searchField":"vmw_esxi_scsi_host_status_label",
    "aliases":[{
        "key":"OK",          "value":"0x0"},{
        "key":"NO_CONNECT",  "value":"0x1"},{
        "key":"BUS_BUSY",    "value":"0x2"},{
        "key":"TIME_OUT",    "value":"0x3"},{
        "key":"BAD_TARGET",  "value":"0x4"},{
        "key":"ABORT",       "value":"0x5"},{
        "key":"PARITY",      "value":"0x6"},{
        "key":"ERROR",       "value":"0x7"},{
        "key":"RESET",       "value":"0x8"},{
        "key":"BAD_INTR",    "value":"0x9"},{
        "key":"PASSTHROUGH", "value":"0xa"},{
        "key":"SOFT_ERROR",  "value":"0xb"
    }]
},{
    "name":"vmw_esxi_scsi_device_status",
    "searchField":"vmw_esxi_scsi_device_status_label",
    "aliases":[{
        "key":"GOOD",                 "value":"0x0"},{
        "key":"CHECK CONDITION",      "value":"0x2"},{
        "key":"CONDITION MET",        "value":"0x4"},{
        "key":"BUSY",                 "value":"0x8"},{
        "key":"RESERVATION CONFLICT", "value":"0x18"},{
        "key":"TASK SET FULL",        "value":"0x28"},{
        "key":"ACA ACTIVE",           "value":"0x30"},{
        "key":"TASK ABORTED",         "value":"0x40"
    }]
},{
    "name":"vmw_esxi_scsi_sense_code",
    "searchField":"vmw_esxi_scsi_sense_label",
    "aliases":[{
        "key":"NO SENSE",        "value":"0x0"},{
        "key":"RECOVERED ERROR", "value":"0x1"},{
        "key":"NOT READY",       "value":"0x2"},{
        "key":"MEDIUM ERROR",    "value":"0x3"},{
        "key":"HARDWARE ERROR",  "value":"0x4"},{
        "key":"ILLEGAL REQUEST", "value":"0x5"},{
        "key":"UNIT ATTENTION",  "value":"0x6"},{
        "key":"DATA PROTECT",    "value":"0x7"},{
        "key":"BLANK CHECK",     "value":"0x8"},{
        "key":"VENDOR SPECIFIC", "value":"0x9"},{
        "key":"COPY ABORTED",    "value":"0xA"},{
        "key":"ABORTED COMMAND", "value":"0xB"},{
        "key":"VOLUME OVERFLOW", "value":"0xD"},{
        "key":"MISCOMPARE",      "value":"0xE"
    }]
}],

For each existing field, this definition adds another field with values that have user-friendly names:

  • For the vmw_esxi_scsi_host_status field, the definition adds a vmw_esxi_scsi_host_status_label field with a value that is a user-friendly name. For example, a field value of "0x1" for vmw_esxi_scsi_host_status produces a vmw_esxi_scsi_host_status_label value of "NO_CONNECT".
  • For the vmw_esxi_scsi_device_status field, the definition adds a vmw_esxi_scsi_device_status_label field with a value that is a user-friendly name. For example, a field value of "0x2" for vmw_esxi_scsi_device_status produces a vmw_esxi_scsi_device_status_label value of "CHECK CONDITION".
  • For the vmw_esxi_scsi_sense_code field, the definition adds a vmw_esxi_scsi_device_sense_label field with a value that is a user-friendly name. For example, a field value of "0x3" for vmw_esxi_scsi_sense_code produces a vmw_esxi_scsi_device_sense_label value of "MEDIUM ERROR".

Dynamic Aliases

Dynamic aliases are configured by using the following fields:

Field Description
aliasRules The dynamic mapping of a valueField to a keyField for associatedFields.
name A unique name to identify the alias (internal only).
keyField The field for which a dynamic alias should be mapped against.
valueField A second field in the same event as the keyField that provides the alias value.
aliasFieldName The name of the alias field to be shown next to the events that contain the keyField.
associatedFields The field or fields for which the aliasFieldName should appear.
definition A dynamic alias is defined as:
"aliasRules":[{
    "name":"DatastoreFromVmFileSystem",
    "filter":"hostd VmFileSystem Label headExtent naa*",
    "keyField":"vmw_esxi_device_id",
    "valueField":"vmw_esxi_vmfs_label",
    "aliasFieldName":"vmw_esxi_vmfs_name",
    "associatedFields":[
        "vmw_esxi_device_id"
    ]
},{
    "name":"DatastoreFromScsiCorrelator",
    "filter":"scsiCorrelator storage Datastores naa*",
    "keyField":"vmw_esxi_device_id",
    "valueField":"vmw_esxi_datastore",
    "aliasFieldName":"vmw_esxi_datastore_name",
    "associatedFields":[
        "vmw_esxi_device_id"
    ]
}],

For the dynamic alias fields to function, vRealize Log Insight requires specific messages to be logged to build the aliases.

  • For the vmw_esxi_vmfs_name field to work correctly, vRealize Log Insight must first receive a log message similar to:

    016-10-22T00:50:00.042Z host001.corp.local Hostd: info hostd[5179FB70] [Originator@6876 sub=Libs]
    VmFileSystem: uuid:57925c06-0a8a627e-9f0b-b82a72d50b06, Label:datastore001,logicalDevice:57925c05-63b188db-37da-b82a72d50b06, headExtent:naa.6b083fe0c212bd001f22e05d07099022:1

    The query used to match this event is hostd VmFileSystem Label headExtent naa*. For every unique vmw_esxi_device_id field value found, vRealize Log Insight maps the value of the vmw_esxi_vmfs_label field to the vmw_esxi_vmfs_name field. In this example, the vmw_esxi_device_id field is "naa.6b083fe0c212bd001f22e05d07099022" and the vmw_esxi_vmfs_label field is "datastore001". After this event is logged, running a query with a filter in which the vmw_esxi_vmfs_name field contains a datastore name returns log messages that contain "naa.6b083fe0c212bd001f22e05d07099022".

  • For the vmw_esxi_datastore_name field to work correctly, vRealize Log Insight must first receive a log message similar to:

    2016-11-24T03:56:47.738Z host002.corp.local vobd:  [scsiCorrelator] 4851129307827us: [esx.clear.storage.redundancy.restored]
    Path redundancy to storage device naa.6006016006502a004b1c42e756fbe411 (Datastores: "datastore002") restored. Path vmhba39:C0:T1:L2 is active again.

    The query used to match this event is scsiCorrelator storage Datastores naa*. For every unique value found in the vmw_esxi_device_id field, vRealize Log Insight maps the value of the vmw_esxi_datastore field to the vmw_esxi_datastore_name field. In this example, the vmw_esxi_device_id field is "naa.6006016006502a004b1c42e756fbe411" and the vmw_esxi_datastore field is "datastore002". After this event is logged, running a query with a filter in which the vmw_esxi_datastore_name field contains a datastore name returns log messages that contain "naa.6006016006502a004b1c42e756fbe411".

Requirements for Aliases

To use aliases, ensure that:

  • You are using vRealize Log Insight 4.0 or later.
  • You are using the VMware - vSphere content pack 4.0 or later. vRealize Log Insight includes this content pack.
  • ESXi is configured to send logs to vRealize Log Insight.
  • There is a minimum gap of five minutes after the first event that contains both the key and value goes through the ingestion pipeline.

Restrictions for Aliases

The following restrictions apply to the use of aliases:

  • You cannot use aliases with mathematical functions, for example, avg, min, max, and so on.
  • You cannot use aliases with the "exists" and "does not exist" operators.
  • Aliases are not forwarded as a part of log forwarding.
  • Up to 100,000 aliases can be learned per node, after which they are rotated out in a FIFO manner.