How Runecast Analyzer automates VMware log analysis

It is extremely difficult, if not impossible, for even the most seasoned IT veterans to  manually process hundreds of logs every day and translate it all into actionable insights.

The traditional, business-as-usual approach is a break-fix cycle that is reactive at best – and most of the time once an issue is identified, there are often no clear steps to resolution.

Introducing automated log analysis

Runecast Analyzer allows IT administrators to save time and make sense of all the data in their ESXi logs by proactively monitoring for known misconfigurations in real time. 

Our customers report saving as much as 90% of time previously spent troubleshooting. (Source: Near East Bank case study)

Runecast Analyzer scans specific configurations and provides Best Practice fit-gap analysis reports along with clear steps to resolve any discovered issues. 

• Built-in vCenter log insights analysis
• Removes search time and reduces delays in solving issues
• Parses the logs from your ESXi logs and VMs
• Filters entries based on important keywords: FailedTo, SCSI_command, NMP, Unableto, Error, and shell

Log KBs Discovered

Runecast continuously monitors the logs it receives, searching for log patterns that are described in various VMware KB articles. The Log KBs Discovered view displays all of the articles which VMware have created about log issues.

Configure Log Collection

Runecast offers real-time analysis of logs received from the vSphere hosts and VMs. As your hosts may already be forwarding their logs to a standard syslog collector, Runecast can be configured as an additional syslog destination. Logs will continue to be sent to your other syslog server(s), and you do not need to delete any current syslog server addresses. Runecast will retain only the relevant log entries that may indicate a potential issue.

The log configuration can be carried out at any time. Runecast Analyzer starts to analyze the logs immediately after they are forwarded to the appliance.

Log Forwarding

This can be automatically configured through Runecast Analyzer, applied through the PowerCLI or configured manually.

Log Inspector

Along with the documented issues in VMware KBs, Runecast Analyzer filters and tags common syslog error messages that may indicate a problem. The tagged log entries are represented in a historical chart that can be examined by the administrator. A smaller navigation chart is located under the main log chart. The navigation chart can be used to change the time range of the displayed logs.

Initially, the chart displays the occurrence frequency of log strings that could indicate a problem, such as Unableto, CouldNot, FailedTo, Error, etc. Sysadmins can explore deeper the log messages for that string (by keyword) using the drop-down menu. An additional graph will appear that includes a list of the keywords that SysAdmins would usually have to search for manually.

The administrator can create various filters – for log entries based on their syslog-message field and for specific hostname or program.

Conclusion

It no longer has to be difficult or time consuming for IT Admins to analyze their logs. All that is required is a change of mindset, away from business-as-usual approaches toward a sensible use of automation where it can help to enable the IT team with actionable steps for what to prioritize and focus on next.

With the ability to search syslogs in seconds, by host and program, or by using the search facility, sysadmins have all of the information they require for remediation right at their finger tips.

IT teams can stop the break-fix cycle, switch to a proactive approach, and free up time for IT initiatives that can help grow the business.