How to configure VMware Identity Manager to send logs to Log Insight

In this demonstration, I have used vIDM 3.1, Log Insight 4.5.1 and vIDM content pack 1.1

Step 1:

Install VMware Identity Manager Content Pack

Login to Log Insight as admin, click on settings icon in top right -> Content Packs -> Select VMware Identity Manager and click Install (In my case I already installed, hence showing installed)

Step 2:

Select VMware Identity Manager under Installed Content Packs -> Select the settings icon -> click on Setup Instructions.

Here you can read through the Setup Instructions

Step 3:

Go to Administration -> Select Agents under Management -> Download the Log Insight Agent.

Here we will be downloading Linux RPM (32-bit/64-bit)

Step 4:

Copy the Log Insight Agent to VMware Identity Appliance. In this example I have used WinSCP to copy to /tmp location. (username: sshuser to connect to VMware Identity Appliance)

Step 5:

Install the Log Insight Agent RPM file by following below steps:

  1. Take a SSH session to VMware Identity Appliance (username: sshuser)
  2. cd /tmp
  3. rpm -i VMware-Log-Insight-Agent-4.5.0-5626690.noarch_10.109.26.113.rpm

 

Step 6:

Now we must edit the liagent.ini file present in location /var/lib/loginsight-agent, two steps:

  1. Open the file with a text editor: vi liagent.ini
  • Uncomment the hostname and provide the Log Insight hostname/IP
  • Uncomment the proto

2. Copy the Agent Groups configuration completely and paste it in liagent.ini file (at the bottom)

Step 7:

If you got Administration -> Agents -> Select All Agents, you would see your VMware Identity Manager hostname already listed and sending Events

Step 8:

You can create a new Agent group only for VMware Identity Manager like the image below

(Steps to create new Agent Group is mentioned in “Setup Instructions of Content Pack”)

Result in dashboard: