MCP 服务器

vmware-aria-logs

MCP server for querying and analyzing logs from VMware Aria Operations for Logs, enabling log search, incident detection, and vROps correlation.

README

VMware Aria Operations for Logs — MCP Server

MCP server for querying and analyzing logs from VMware Aria Operations for Logs (formerly vRealize Log Insight). Provides log search, mass incident detection, and optional VMware Aria Operations (vROps) correlation.

Built for use with Claude Code, Claude Desktop, LobeChat, and any MCP-compatible client.

Features

Log Search — Query events with time range, text filters, and field constraints via Log Insight API v2
Incident Detection — Signature-based clustering to identify mass log incidents (Stormbreaker engine)
API Surface Probe — Detect appliance version and available API endpoints
Dashboard Listing — Enumerate saved dashboards (legacy vRLIC API, deprecated on 8.18+)
vROps Correlation — Cross-reference log entities with Aria Operations resources and alerts

Quick Start

Install via uvx (recommended)

uvx vmware-aria-logs

Install via pip

pip install vmware-aria-logs

Run with environment variables

export LI_BASE_URL=https://loginsight.example.com
export LI_USERNAME=admin
export LI_PASSWORD=your-password
export LI_PROVIDER=Local

vmware-aria-logs

MCP Tools

Tool	Description
`query_events`	Search log events with time range, text filter, field constraints
`get_version`	Get appliance version and probe API surface
`list_dashboards`	List saved dashboards (legacy vRLIC API, deprecated on 8.18+)
`detect_incidents`	Mass incident detection via signature clustering
`find_vrops_resources`	Find entities in Aria Operations by name
`get_vrops_alerts`	Get alerts for specific vROps resources

Configuration

Required Environment Variables

Variable	Description	Default
`LI_BASE_URL`	Log Insight appliance URL	—
`LI_USERNAME`	API username	`admin`
`LI_PASSWORD`	API password	—
`LI_PROVIDER`	Auth provider (Local, ActiveDirectory)	`Local`
`LI_VERIFY_TLS`	Verify TLS certificates	`false`
`LI_TIMEOUT_SEC`	HTTP request timeout (seconds)	`30`

Optional (vROps Correlation)

Variable	Description	Default
`VROPS_BASE_URL`	Aria Operations URL	—
`VROPS_USERNAME`	vROps username	`admin`
`VROPS_PASSWORD`	vROps password	—
`VROPS_AUTH_SOURCE`	Auth source	`local`
`VROPS_VERIFY_TLS`	Verify TLS certificates	`false`
`VROPS_TIMEOUT_SEC`	HTTP request timeout (seconds)	`30`

Claude Code / MCP Client Configuration

{
  "mcpServers": {
    "aria-logs": {
      "command": "uvx",
      "args": ["vmware-aria-logs"],
      "env": {
        "LI_BASE_URL": "https://loginsight.example.com",
        "LI_USERNAME": "admin",
        "LI_PASSWORD": "your-password"
      }
    }
  }
}

Why This Server?

VMware Aria Operations for Logs (Log Insight) is widely deployed in enterprise VMware environments, but lacks modern AI-assisted log analysis tooling. This MCP server bridges that gap:

Zero dependencies beyond the MCP SDK — uses Python stdlib urllib for HTTP
Stormbreaker engine — unique signature-based clustering that finds mass incidents humans miss
vROps correlation — cross-reference log events with infrastructure health in a single conversation
Works on v8.x+ — tested on Aria Operations for Logs 8.18.3, gracefully degrades deprecated APIs