Forward Avamar Proxy log files to Log Insight

This post covers how to configure integration between Avamar Proxy Servers and VMware Log Insight.

I posted previously about how to Forward Avamar log files to VMware Log Insight, but this post covers how to compliment and expand that by including the log files of Avamar Proxy servers.

While forwarding Avamar Server log files is achieved using native Avamar Event Profiles, the ability to forward the log files of Avamar Proxy servers to Log Insight was introduced with Avamar v7.4.

This post basically walks through what the official doc states (Appendix C), and provides some visuals to help understand a little more.

The flow of information is Avamar Proxy Server to Avamar Server to Log Insight Server

A Log Forwarding Agent (LFA) runs on each Avamar Proxy server, which every 10mins runs a cron job sending the logs to a Log Central Reporting Service (LCRS) running on the Avamar Server

The LCRS on the Avamar Server then forwards the Avamar Proxy logs to the Log Insight server.

Configure the Log Central Reporting Service on the Avamar Server

First we need to configure the LCRS on the Avamar Server.

  1. Log into the Avamar Server as root
  2. Change to the /usr/local/emc-lcrs/etc/ directory
  3. Open the lcrs.ini in a text editor

Two entries need to be changed in this file:

  • forward.server=<IP address of Log Insight Appliance>
  • upload.forward=true

The server and forward ports, and everything else, can be left at default.

Configuring the Log Forwarding Agent (LFA) on the Avamar Proxy Server

We now need to configure the Proxy Servers which are running Log Forwarding Agents (LFAs) to send the logs to the Avamar Server.

  1. Log in to each Avamar Proxy Server as root
  2. Change to /usr/local/avamarclient/etc
  3. Run ./proxylfa_setup.sh

You are presented with 4 options.

Choose Option 1: Setup LCRS IP address, and enter the IP address of the Log Insight Appliance (This can be any one of the LI nodes)

Next, the 4 options are again presented, and this time select Option 2: Enable Avamar VMware Log Forwarding Agent cron job

Once complete, select Option 4 to Quit

Almost there, not long to go from here ….

That’s it for the configuration of the Avamar components, the next step is to find the events in Log Insight.

Open up the Interactive Analytics tab in the Log Insight UI, and create a new filter, as follows:

vmw_product_proxy – contains – <avamar_proxy_sourceUID>

The first 2 filters are standard, but the source UID of the Avamar Proxy Servers is not something that trips off the tongue as easily.

There are few ways to get this … the simplest being to just click the text field in the filter, and LI will present a list of those objects that already match the ‘vmw_product_proxy contains’ filter, as shown below.

Note that the Avamar Proxy Source UID entry will not exist unless at least one successful cron job has been received by the LI appliance.

In the example above, the list contains multiple old Avamar Proxy entries, so I can trial and error which ones are active in the relevant timeframe, but to be certain it’s best to verify the source UID on each of the Avamar Proxy Servers, as follows:

On the Avamar Server, open the lcrs.log file @ /usr/local/emc-lcrs/log/lcrs.log and search for a string of HttpStatus.OK: true

This string will be present and associated with the forwarding operations of the proxy sources, as shown below where you can see the overall process on the Avamar Server:

It’s also possible to add another filter such as:

text – contains – <AvamarProxy_IPaddress>

This will match the source UID and IP address for the Proxy Server, as shown below where we have 2 Avamar Proxy Servers configured for our VVD on VxRail Cloud Management Pod (CMP).

Now that we have the events being forwarded and received successfully, it’s possible to create a new custom Log Insight Dashboard to display these events as per the business requirements.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.