Early last week, VMware made its vRealize Log Insight product available in a free limited form. The short version is that every copy of vCenter (full fat, not just essentials, as far as I can see) gets twenty-five restricted licenses of Log Insight now, rolled out through the usual software channels. This is an automatic upgrade, and the download is available with no further action.
Log Insight is the VMware log file aggregation and data mining product that is part of the vRealize Operations suite of products. It is not limited to VMware products and can take syslogs from any Linux/Unix system, from network devices, and even from Windows Servers. This offers a single point of “insight” (hence the product name)—a place where administrators can go to dig when there are problems. Of course, it also aggregates the logs from vCenter and the ESXi hosts, which is where this free release comes in.
The restricted licenses can only be used for vCenter and ESX/ESXi hosts, although twenty-five licenses (per vCenter Server) should be enough for the majority of users to begin monitoring their entire VMware estate. It’s to be assumed that VMware hopes that from here, customers will buy licenses for the full product in order to bring server and application monitoring into the fold.
The most widely known alternative to Log Insight is probably Splunk, but others exist, such as the open-source Greylog and the commercial Sumo Logic. Splunk and Sumo Logic each provide a free version that is “data limited” and stops taking in logs after a certain threshold is reached each day. Greylog works at no cost, but support and advanced features require purchase.
This change by VMware, then, brings Log Insight into line with its competitors, offering free functionality to get users on board and interested and then charging for the more useful features later. It is arguably a much more useful system, too. We’ve all gone to Splunk to troubleshoot an issue, only to find that not all of the logs we need were ingested due to its having hit the daily limit!
The big question for me is “Why make this change now?” Log Insight has been around for a few years and is a useful part of the vRealize suite of tools (along with Operations Manager and Orchestrator). vRealize has been very easy to purchase alongside vSphere for a few years (under one name or another) as another combined SKU. It seems odd to make this change now, unless it is part of some greater shift in focus.
The second question this change prompts is “Why just Log Insight?” As mentioned above, Log Insight is one part of the vRealize suite. It is no less useful than vRealize Operations Manager (vROps), although it is perhaps less unique. Restricting Log Insight to just taking data from vCenter and ESXi does limit the product (giving users a firm reason to upgrade), whereas a similar limit in vROps or vRealize Orchestrator would be be fairly meaningless. However, the particulars of the license limit could have been decided to make it work for all three products by limiting to a number of hosts in a more meaningful way. It could be that attracting users to Log Insight is seen as a way of attracting new users into the vRealize suite as a whole, and that this is enough. Or it could be that VMware sees the other two products as unique enough that there is no need to use gimmicks like this to attract users.
My final question is “Why has VMware been so quiet about this change?” I only heard about the change at a local VMUG, although since early February there has been a placeholder on the Log Insight product page to sign up for notification of when the change goes live. A few blogs have picked up the change this week, too, but all in all, it’s been very quiet. If the idea is to attract more users to the product, it’s a strange way of going about it!
Overall, this is a positive change for users. The Log Insight product is a solid one that is immensely useful for troubleshooting. The limitations on the license are not onerous for small and medium businesses, and even most enterprises will gain a big benefit from using it. It brings the product more in line with its competitors and sets the stage for the rest of the suite.