AD Integration
we need to use AD, specifically AD groups, to manage access to loginsight, and we need it to be a secure connection.
For us, the best integration would be to have these LDAP connection settings:
- Host & Port
- SSL enabled
- Bind DN & Bind DN Password
- User base DN
- Group base DN (Use Nested groups)
I tried to configure AD based on LogInsight 1.5 beta documentation and use secure ldap protocol
Document: log-insight-15-administration-guide.pdf
small typo - /usr/lib/loginisight/application/etc/loginsight-config-base.xml
should be - /usr/lib/loginisight/etc/application/loginsight-config-base.xml
Issue 1
"LogInsight EMS Admins" - group in AD
- Adding AD group does not work – SOME users in that AD group are not able access loginsight...
- we have more than 1 domain: corp.emc.com; eng.emc.com... some users have UPN suffix that is simply "@emc.com"
- we use service account to bind to AD, it is in corp.emc.com domain
1. change config:
add <ad-protocols value="LDAPS" /> For specifically using LDAP with SSL only
- how to verify it uses ldaps? is it really ldaps?
2. service loginsight restart
Issue 2 (known - ESX stopped sending the data)
3. Lost the data
The host "loginsight:514" has become unreachable. Remote logging to this host has stopped.
4. Administration -> Integration -> vSphere
ESXi hosts configured to send logs to Log Insight
click "View ESXi syslog configuration details..."
Verify list of "Configured" ESXi hosts, select them and "Configure Selected" again
- is it possible to "automate" this when there is a need to restart LogInsight?
5. the data is back– need to verify if we have double entries in ESX logging section
Thanks,
ildus