vRealize Log Insight maps predefined vSphere datastore names to device IDs. Because of this mapping, you can use datastore names that are aliases for device IDs in queries. The query finds messages with the datastore name or the device ID for which it is aliased. vRealize Log Insight must receive both the key (datastore name) and its value (datastore ID) in messages before the alias can be enabled.
Aliases are defined in the VMware-vSphere content pack. Aliases can be static or dynamic.
Static Aliases
Static aliases are configured by using the following fields:
| Field | Description |
|---|---|
| aliasFields | The static mapping of a value to a key for a given searchField. |
| name | The name of the alias field. |
| searchField | The name of the field for which an alias is desired. |
| value | The value of the searchField to match. |
| key | The alias to display with events that contain the searchField. |
| definition | A static alias is defined as:"aliasFields":[{
"name":"vmw_esxi_scsi_host_status",
"searchField":"vmw_esxi_scsi_host_status_label",
"aliases":[{
"key":"OK", "value":"0x0"},{
"key":"NO_CONNECT", "value":"0x1"},{
"key":"BUS_BUSY", "value":"0x2"},{
"key":"TIME_OUT", "value":"0x3"},{
"key":"BAD_TARGET", "value":"0x4"},{
"key":"ABORT", "value":"0x5"},{
"key":"PARITY", "value":"0x6"},{
"key":"ERROR", "value":"0x7"},{
"key":"RESET", "value":"0x8"},{
"key":"BAD_INTR", "value":"0x9"},{
"key":"PASSTHROUGH", "value":"0xa"},{
"key":"SOFT_ERROR", "value":"0xb"
}]
},{
"name":"vmw_esxi_scsi_device_status",
"searchField":"vmw_esxi_scsi_device_status_label",
"aliases":[{
"key":"GOOD", "value":"0x0"},{
"key":"CHECK CONDITION", "value":"0x2"},{
"key":"CONDITION MET", "value":"0x4"},{
"key":"BUSY", "value":"0x8"},{
"key":"RESERVATION CONFLICT", "value":"0x18"},{
"key":"TASK SET FULL", "value":"0x28"},{
"key":"ACA ACTIVE", "value":"0x30"},{
"key":"TASK ABORTED", "value":"0x40"
}]
},{
"name":"vmw_esxi_scsi_sense_code",
"searchField":"vmw_esxi_scsi_sense_label",
"aliases":[{
"key":"NO SENSE", "value":"0x0"},{
"key":"RECOVERED ERROR", "value":"0x1"},{
"key":"NOT READY", "value":"0x2"},{
"key":"MEDIUM ERROR", "value":"0x3"},{
"key":"HARDWARE ERROR", "value":"0x4"},{
"key":"ILLEGAL REQUEST", "value":"0x5"},{
"key":"UNIT ATTENTION", "value":"0x6"},{
"key":"DATA PROTECT", "value":"0x7"},{
"key":"BLANK CHECK", "value":"0x8"},{
"key":"VENDOR SPECIFIC", "value":"0x9"},{
"key":"COPY ABORTED", "value":"0xA"},{
"key":"ABORTED COMMAND", "value":"0xB"},{
"key":"VOLUME OVERFLOW", "value":"0xD"},{
"key":"MISCOMPARE", "value":"0xE"
}]
}],For each existing field, this definition adds another field with values that have user-friendly names:
|
Dynamic Aliases
Dynamic aliases are configured by using the following fields:
| Field | Description |
|---|---|
| aliasRules | The dynamic mapping of a valueField to a keyField for associatedFields. |
| name | A unique name to identify the alias (internal only). |
| keyField | The field for which a dynamic alias should be mapped against. |
| valueField | A second field in the same event as the keyField that provides the alias value. |
| aliasFieldName | The name of the alias field to be shown next to the events that contain the keyField. |
| associatedFields | The field or fields for which the aliasFieldName should appear. |
| definition | A dynamic alias is defined as:"aliasRules":[{
"name":"DatastoreFromVmFileSystem",
"filter":"hostd VmFileSystem Label headExtent naa*",
"keyField":"vmw_esxi_device_id",
"valueField":"vmw_esxi_vmfs_label",
"aliasFieldName":"vmw_esxi_vmfs_name",
"associatedFields":[
"vmw_esxi_device_id"
]
},{
"name":"DatastoreFromScsiCorrelator",
"filter":"scsiCorrelator storage Datastores naa*",
"keyField":"vmw_esxi_device_id",
"valueField":"vmw_esxi_datastore",
"aliasFieldName":"vmw_esxi_datastore_name",
"associatedFields":[
"vmw_esxi_device_id"
]
}],For the dynamic alias fields to function, vRealize Log Insight requires specific messages to be logged to build the aliases.
|
Requirements for Aliases
To use aliases, ensure that:
- You are using vRealize Log Insight 4.0 or later.
- You are using the VMware - vSphere content pack 4.0 or later. vRealize Log Insight includes this content pack.
- ESXi is configured to send logs to vRealize Log Insight.
- There is a minimum gap of five minutes after the first event that contains both the key and value goes through the ingestion pipeline.
Restrictions for Aliases
The following restrictions apply to the use of aliases:
- You cannot use aliases with mathematical functions, for example, avg, min, max, and so on.
- You cannot use aliases with the "exists" and "does not exist" operators.
- Aliases are not forwarded as a part of log forwarding.
- Up to 100,000 aliases can be learned per node, after which they are rotated out in a FIFO manner.
