Edit

Share via

Send VMware syslogs to log management server using Azure Logic Apps

  • Article

Azure Logic Apps enables you to automate workflows by integrating various Azure services and third-party applications. You can use Logic Apps to collect and forward VMware syslogs from your Azure VMware Solution private cloud to any log management service of your choice. This approach allows for centralized log storage, analysis, and monitoring across your preferred tools.

In this article, learn how to configure an Azure Logic Apps workflow to capture VMware syslogs and send them to your chosen log management service.

Architecture flow of Azure VMware Solution logs to syslog server via Azure Logic Apps.

Prerequisites

Make sure you have an Azure VMware Solution private cloud set up that is streaming its syslogs to an Azure Event Hubs instance.

Configure VMware syslogs - Stream to Microsoft Azure Event Hubs.

Create an Azure Logic Apps instance

  1. From your Azure portal, select Create a resource, then search for Logic App. Find the one called Logic App, select Create, then click Logic App.

Screenshot showing where to procure an instance of Azure Logic Apps.

  1. Select the Hosting plan that makes the most sense for your consumption needs. In most cases, the Workflow Service Plan should suffice.

Screenshot showing which hosting option of Azure Logic Apps to select.

  1. Enter the Subscription you intend to use, the Resource Group chosen to house this instance. Give it a name and select a region. The default Windows plan is Workflow Standard WS1 (210 total ACU, 3.5 Gb memory, 1 vCPU) which should be enough to handle log volumes from large workloads. This option can always be adjusted later, as needed. After filing these details, select Review + create.

Screenshot showing the fields that need to be populated when creating an Azure Logic App.

  1. Review the details of the Logic App instance. Select Create. Clicking this button initializes the deployment of the Logic App instance. Once complete, the deployment status will read "Your deployment is complete".

Screenshot showing the summary of the Logic App creation.

Set up the Azure Logic App workflow

  1. Once deployed, navigate to the Logic App instance. Select Workflows, then click on Workflows. Select Add, then click on Add from Template. This action takes you to the template catalog available in Azure Logic Apps.

Screenshot showing the Workflows blade of Azure Logic App.

  1. In the search bar, search for Azure VMware Solution. Click on the option called Azure VMware Solution: Export private cloud logs to log management solution.

Screenshot showing Azure VMware Solution option under Workflow templates in the Logic App.

  1. On the right hand pane, select Use this template at the bottom of the screen. Give the workflow a name and select Stateful for State type.

Screenshot showing the Workflow name and State type for the Azure VMware Solution template.

  1. Next, connect the Event Hub that houses the Azure VMware Solution logs to this Logic App instance. To do so, click Connect. Provide a name for Connection Name, Authentication Type will remain Access Key. For Connection String, you need to retrieve the Connection String from the Event Hub instance you intend to use.

Screenshot showing the Event Hubs connection portion of the Azure VMware Solution template.

  1. In a separate browser tab, open the Event Hub instance that contains the log messages. Select Settings, then click on Shared access policies. Select RootManagerSharedAccessKey and click on the copy icon next to Primary connection string.

Screenshot showing the Primary connection string on Azure Event Hub.

  1. Navigate back to the browser tab with the Logic App and paste what you just copied into the Connection String field. Click Add Connection.

Screenshot showing the pasting of the Primary connection string on Azure Logic Apps template.

  1. If added successfully, the Status for the Event Hub should read Connected. At this point, click Next to proceed forward.

Screenshot showing successful Connected message on Azure Logic Apps template.

  1. Add the name of the event hub instance under Event hub name. The exact name of the Event hub can be found under Entities, then Event Hubs in your Event Hub tab. Add the URI of the log server you intend to use under Log destination URI. Click Next.

Screenshot showing the necessary parameters needed for the Azure Logic App template.

  1. Finally, review the information provided, then click Create. This action saves the workflow that can be used to send the log messages from Azure VMware Solution to any syslog endpoint.

Screenshot showing the review page before creating the Azure Logic App template.

Adding certificates, updating HTTP headers, and configuring notifications

Certificates

If Azure Logic Apps requires the certificate from the log management server to be trusted, you may need to add the certificate to the Logic Apps instance to enable successful log transmission. This is a necessary step when using tools such as VMware Cloud Foundation Operations for Logs, for example. You may add this to the Azure Logic App instance using the following approach:

  1. Export the certificate from the log management server and save it as a .cer file.

  2. In the Azure Logic App, navigate to Settings > Certificates. Navigate to the tab that says Public key certificates (.cer) and click on Add certificate.

Screenshot showing where to add the Public key certificate in the Azure Logic App instance.

  1. Upload the certificate from Step 1 to CER certificate file and give the certificate a name, then click Add at the bottom.

Screenshot showing where to add the Public key certificate in the Azure Logic App instance and giving it a name.

  1. Once saved, copy the Thumbprint value. We need that for our environment variable in Step 5.

Screenshot showing where to copy the thumbprint of the newly added certificate.

  1. Under Settings, select Environment variables, then select Add. The name of the environment variable to add is WEBSITE_LOAD_ROOT_CERTIFICATES and the value is going to be the thumbprint you copied. Select Apply at the bottom of the panel to save the changes and Apply again at the bottom of the list of environment variables to apply these changes. The new environment variable should take effect.

Screenshot showing the successfully added environment variable.

HTTP Headers

By default, the HTTP-Trigger-to-Log-Destination trigger in the workflow you created has the following key-value pairs under Headers:

  • Content-Type : application/json

This works by itself for log management tools such as VMware Cloud Foundation Operations for Logs. You may need to verify the log management server's ingestion cURL command to see if there are other headers that may need to be added. If you see other headers, add them here and click Save at the top, so that the logs can be ingested properly into your log management server.

Screenshot showing where headers can be modified inside the workflow.

Run History

The Run History section of a workflow in Azure Logic Apps provides a detailed log of workflow executions, helping you track successful runs, diagnose failures, and troubleshoot issues. By reviewing the timestamps, status codes, and error messages, you can ensure your Azure VMware Solution syslog forwarding process is running smoothly and quickly identify any disruptions.

Screenshot showing Run History can be accessed.

Configuring Notifications

You will notice in the last step of the workflow that there is an optional item called Optional-Notification (README). You may replace this item with one of the available actions in Azure Logic Apps, such as Outlook emails or Teams messages, to notify you in the event there is a failure sending your logs to your log management server.

Screenshot showing where notifications can be added inside the workflow.