The files that contain system messages are located on the Log Insight virtual appliance.




Used to track all run time information related to Log Insight


Used to track database start or stop events


Used to track all queries


Used to track events related to the Log Insight user interface


Used to track the run time events of the watch dog process, which is responsible for restarting Log Insight if it is shutdown for some reason


Used to trace events related to integration with vSphere


Used for the standard output of Log Insight daemon


Used to track events that occur during Log Insight upgrade


Used to track events from Apache Tomcat server


Used to track events related to the vCenter Operations Manager integration


Used to track the events of the Postgres server


Used to track the events that occur at first boot and configuration of the Log Insight virtual appliance


Used to track storage related events, such as adding a new disk to the Log Insight virtual appliance

The runtime.log file contains user audit log messages in the following format.

[2013-05-17 20:40:18.716+0000] [http-443-5 INFO /] [com.vmware.loginsight.web.actions.misc.LoginActionBean][User logged in: Name: admin | Role: admin]

[2013-05-17 20:39:51.395+0000] [http-443-5 INFO /] [com.vmware.loginsight.web.actions.misc.LoginActionBean][User logged out: Name: admin | Role: admin]

[20130918 12:39:34.8230700] [http94433 WARN /] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [Bad username/password attempt (username: myusername)]

[20130918 12:40:08.7610700] [http94433 INFO /] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User logged in: Active Directory User: SAM=myusername,,]

[ 20130918 12:40:20.2320700] [http94433 INFO /] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User logged out: Active Directory User: SAM=myusername,,]

[20130918 12:40:36.9330700] [http94433 INFO /] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User logged in: Local User: Name=myusername, Role=user]

[20130918 12:40:40.4290700] [http94433 INFO /] [com.vmware.loginsight.web.actions.misc.LoginActionBean] [User logged out: Local User: Name=myusername, Role=user]

[2013-11-13 23:26:21.569+0000] [http-443-4 INFO /] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Created new user: Active Directory User: SAM=username,,]

[2013-11-14 22:44:11.017+0000] [http-443-6 INFO /] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Created new user: Local User: Name=username, Role=admin]

[2013-12-05 21:03:36.751+0000] [http-443-3 INFO /] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Removed users: [Active Directory User: SAM=username,,]]

[2013-12-05 21:04:16.707+0000] [http-443-3 INFO /] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Removed users: [Local User: Name=username, Role=admin]]

[http-9443-3 INFO /] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Created new group: (, group=VMware Employees, role=user)]

[2013-12-05 13:07:04.108-0800] [http-9443-2 INFO /] [com.vmware.loginsight.web.actions.settings.UsersActionBean] [Removed groups: [(, group=VMware Employees, role=user)]]