Have you ever opened up the VMware Hardening Guide and checked your environment against every single item listed? How about combed through the VMware Knowledge Base looking for all KB articles that apply to the exact software builds and hardware you have? No? How about taken a list of industry best practices and ensured that you are indeed configured in the best possible way? Of course we haven’t – that would certainly take a lot of time and most organizations simply don’t have the resources to throw at those types of tasks. All that said what if I told you that there was a piece of software that could pretty much instantly tell you whether you are or are not compliant in those exact three scenarios? Interested yet? I thought you might be…
Enter Runecast
Before writing this review I’d never heard of Runecast, so first, a little bit about the company. Runecast was founded in 2014 in the quaint ol’ city of London in the UK. Their goal, to provide pro-active monitoring to our vSphere environments in order to save us time, prevent outages before they happen, ensure compliance at all times and simply make our environments more secure. Now there is only four things listed there – but they are four things that Runecast does really, really well. With that said, I could talk about how much I enjoyed doing this review forever, but it’s best just to jump right in and get monitoring…
Configuration
As far as installation goes Runecast come bundled as a virtual appliance, so it’s just a matter of deploying the analyzer into our environment. To help you get started Runecast offers a 30 day full-featured free trial that you can try out! Configuration wise we really only have a couple of steps to perform; pointing the Runecast Analyzer at our vCenter Server and configuring our ESXi hosts to forward their logs. After deployment you should be brought to a screen similar to the one shown to the left. Simply follow the ‘Settings’ link and enter in your required vCenter Server information into Runecast as shown below.
Remember how we mentioned that configuration is divided into two steps. The first, connecting to our vCenter environment is now complete. The second, setting up the forwarding of logs is completely optional and can be completed at any time. We can still get valuable data from Runecast without having log forwarding set up, however in order to achieve a more holistic view of our environment we will continue to setup log forwarding.
There are many ways to setup our ESXi hosts to send their logs to Runecast. We can set them up manually, use some a PowerCLI script, or enter the Runecast Analyzer information into our Host Profile. The Runecast interface has the smarts to configure this for us as well. This review will follow the steps in order to setup log forwarding from within the Runecast Analyzer UI.
Selecting the “Status” section from the Log Analysis group, and then clicking on the ‘wrench’ icon will allow us to configure one or many of our hosts to send their log files to Runecast. This process provides the same results as if we were to go and set the syslog advanced setting directly on the hosts configuration. That said, utilizing Runecast for this seems like a much more automated and easier process. As you can see below, we also have the option to send our VM log files as well which is a good idea if you are looking for complete visibility into your virtualization stack.
As far as configuration goes we are now done! That’s it!. 2 simple steps and we are ready to start detecting problems within our environment. The process of going out and collecting data from our vCenter Server is called ‘Analyze’ within Runecast. Our analysis can be configured to occur via a schedule by navigating to the settings page (gear icon in top right) or can be run on-demand by clicking the ‘Analyze Now’ button from any screen within the application.
How long this process takes greatly depends on the size of your environment. My test environment, be it simple and small, only took a couple of minutes to gather the data. I’m sure this time would increase in a 32 host cluster with 1000 or so VMs though. That said, for the amount of data it gathers and the amount of comparisons going on behind the scenes Runecast does a very efficient job at processing everything.
Navigating back to the ‘Dashboard’ as shown below immediately let’s us start to explore the results of this analysis process. Almost instantaneously we can see many issues and best practices that can be applied within our environment. As you can see below I had a number of issues discovered – and I’ve only had Runecast up and running for less than 5 minutes.
Runecast Terminology
Lets take a minute and dig a little into the data that is displayed on the ‘Dashboard’ screen. Mostly everything that Runecast monitors and does is rolled up here, giving us an at-a-glance view of everything you need to know. Let’s break down the items that we are seeing here…
Issues – The term “issue” within Runecast basically represents a detected problem in our infrastructure – this can come from any single or combined instance of configuration settings, log file analysis, or software and hardware versions. Although the source of discovering issues could be from configuration settings or log files, all issues belong to one of three categories within Runecast; Knowledge Base articles, Security Guidelines, or Best Practices, explained below…
KB’s – Runecast actively piles through the vast amounts of VMware Knowledge Base articles and displays to us any that may apply to our environment based on the hardware and software versions and configuration we are running.
Best Practices – All of our inventory objects and configuration items are routinely scanned to determine whether or not they meet any best practices related to VMware. This allows us to see if we simply Pass or Fail in terms having our environment running in it’s best possible configuration.
Security Compliance – Security Compliance takes all of the items within the official VMware Security Hardening guides and compares that to of the configuration of our infrastructure. At a glance we are able to see how we stack up against the recommended security practices provided by VMware.
It’s these four items; Issues, KB’s, Best Practices, and Security Compliance that are at the core of the Runecast analytical engine. Runecast automatically combs through all of these items and determines which ones apply to our environment, then reports back in a slick clean UI, allowing us to see whether we are in compliance or not! In the next part of our review we will go into each of these items in a lot more detail – explaining how to drill down, resolve, and exclude certain metrics from our dashboards. For now , I certainly recommend checking out Runecast for yourself – as you saw, it’s a simple install that can be up and running in your environment very quickly. So, while you wait for part 2 of the review head on over to the Runecast page and grab yourself a free 30 day trial to start reporting on your environment. I’m sure you will be surprised at all of the abnormalities and non-compliant configurations you find right off the hop – I know I was! Stay tuned for part 2.
