vRealize Log Insight can integrate with other VMware products to use events and log data, and to provide better visibility into events that occur in a virtual environment.

Integration with VMware vSphere

You can set up vRealize Log Insight to connect to vCenter Server systems at two-minute intervals, and collect events, alarms, and tasks data from these vCenter Server systems. In addition, vRealize Log Insight can configure ESXi hosts via vCenter Server. See Connect vRealize Log Insight to a vSphere Environment.

Integration with VMware vRealize Operations

You can integrate vRealize Log Insight with vRealize Operations and vRealize Operations Installable. Integrating with the Installable version requires additional changes to the vRealize Operations configuration. For information about configuring vRealize Operations Installable to integrate with vRealize Log Insight, see the Log Insight Getting Started Guide.

vRealize Log Insight and vRealize Operations can be integrated in two independent ways.

Notification Events
You can set up vRealize Log Insight to send notification events to vRealize Operations based on queries that you create. See Configure vRealize Log Insight to Send Notifications and Metrics to vRealize Operations.
Launch in Context
Launch in context is a feature in vRealize Operations that lets you launch an external application via URL in a specific context. The context is defined by the active UI element and object selection. Launch in context lets the vRealize Log Insight adapter add menu items to a number of different views within the Custom user interface and the vSphere user interface of vRealize Operations. See Activate Launch in Context for vRealize Log Insight in vRealize Operations.
Note: Notification events do not depend on the launch in context configuration. You can send notification events from vRealize Log Insight to vRealize Operations even if you do not enable the launch in context feature.

Integration with VMware NSX Identity Firewall

You can set up vRealize Log Insight to integrate with an NSX Manager instance. Within the NSX Manager scope, you can use NSX Identity Firewall(IDFW) to create identity based firewall rules.

After configuring the integration, add predefined third-party identity providers such as GlobalProtect or ClearPass, or custom identity providers to the configuration. vRealize Log Insight parses the auth logs from these providers, extracts user ID-to-IP mapping information, and sends the data to NSX Manager. Based on this data, IDFW defines identity based firewall rules and applies the rules to users for access control.

If the environment changes, you can:
  • Change, add, or remove vSphere systems from vRealize Log Insight.
  • Change or remove the instance of vRealize Operations to which alert notifications are sent.
  • Change or remove the NSX Manager instance.
  • Change the passwords that are used to connect to vSphere systems, vRealize Operations, and NSX Identity Firewall.
,