{
  "markdown": "<!-- mcp-name: io.github.vmware-skills/vmware-log-insight -->\n\n# VMware Log Insight\n\n> **Disclaimer**: Community-maintained open-source project, **not affiliated with,\n> endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** \"VMware\", \"vSphere\",\n> and \"Aria\" are trademarks of Broadcom. Source is publicly auditable under the MIT license.\n\nRead-only log search and aggregation for **VMware Aria Operations for Logs**\n(formerly vRealize Log Insight) — the appliance that collects syslog from ESXi\nhosts, vCenter, and VMs. The centralized-log data source for the VMware skill\nfamily. **Strictly non-destructive**: it queries, it never writes.\n\n## Companion Skills\n\n| Need | Skill | Tools |\n|---|---|:-:|\n| Raw centralized logs + spikes | **vmware-log-insight** (this) | 7 |\n| vCenter events & alarms | [vmware-monitor](https://github.com/vmware-skills/VMware-Monitor) | 27 |\n| Metrics, anomalies, capacity | [vmware-aria](https://github.com/vmware-skills/VMware-Aria) | 28 |\n| Incident correlation / root cause | [vmware-debug](https://github.com/vmware-skills/VMware-Debug) — feed it `log_search` output | 2 |\n| VM lifecycle / operations | [vmware-aiops](https://github.com/vmware-skills/VMware-AIops) | 49 |\n\n## Install\n\n```bash\nuv tool install vmware-log-insight\nmkdir -p ~/.vmware-log-insight\ncp config.example.yaml ~/.vmware-log-insight/config.yaml   # edit host/username/provider\necho 'VMWARE_LOG_INSIGHT_PROD_PASSWORD=...' > ~/.vmware-log-insight/.env\nchmod 600 ~/.vmware-log-insight/.env\nvmware-log-insight doctor\n```\n\n### Offline / Air-Gapped Install (from source)\n\nThis project uses the modern PEP 517 build system (hatchling), so there is **no\n`setup.py`** by design — that is expected, not a missing file. If you cloned the\nsource and hit `ERROR: File \"setup.py\" or \"setup.cfg\" not found ... editable mode\ncurrently requires a setuptools-based build`, your `pip` is older than 21.3 and\ncannot do an *editable* (`-e`) install with a non-setuptools backend. Editable\nmode is a developer convenience, not needed to run the tool — do one of:\n\n```bash\n# From the source tree — a normal (non-editable) install builds a wheel:\npip install .              # NOT  pip install -e .\n\n# ...or upgrade pip first, and editable works too:\npip install --upgrade pip && pip install -e .\n```\n\nFor a **truly air-gapped host**, build the wheels on a connected machine and copy\nthem over — the target then needs no network:\n\n```bash\n# On a connected machine, collect this package + its dependencies as wheels:\npip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)\n\n# Copy dist/ to the air-gapped host, then install offline:\npip install --no-index --find-links dist vmware-log-insight\n```\n\n## MCP Tools (7 — all read-only)\n\n| Tool | What |\n|---|---|\n| `log_search` | Search events by time window + text + filters |\n| `log_aggregate` | Count/aggregate over time bins, with z-score spike detection |\n| `log_fields` | List extracted fields usable in filters |\n| `log_version` | Appliance version/build |\n| `alert_list` / `alert_get` / `alert_history` | Query defined alerts and their trigger history |\n\n## Workflows\n\n- **Find errors fast** — `vmware-log-insight search -q error -l 1h`.\n- **Where did logs burst?** — `vmware-log-insight aggregate -q error -l 6h --bin-ms 300000`, read `spikes[]`, then `search` the spike window.\n- **Root cause** — pass `log_search` results (plus vCenter events from vmware-monitor and metrics from vmware-aria) to **vmware-debug** `incident_timeline`.\n\n## Troubleshooting\n\n- `401 on /sessions` → check username/password/`provider` and the `VMWARE_LOG_INSIGHT_<TARGET>_PASSWORD` env var.\n- `503 everywhere` → appliance starting up; `doctor` reports it as a status, not a crash.\n- Empty results → widen `--last`; default API port is **9543** (set `port` if different).\n\n## Security\n\nRead-only by construction. Credentials in `~/.vmware-log-insight/.env` (`chmod 600`);\nplaintext passwords auto-obfuscated to grep-safe `b64:` (obfuscation, not\nencryption — inject from a secret manager for real secrecy). TLS on by default.\nSee [SECURITY.md](SECURITY.md).\n\n## License\n\nMIT.\n",
  "bytes": 4122,
  "sha": "d6f494456c8f8ea4adb36aaeefce4c3c54e2d2f5d0300337afc0ed42215a2c76",
  "repo_slug": "zw008/vmware-log-insight",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_zw008_vmware_log_insight_4673fb06/readme"
}