We have several ESXi 5.0 Hosts that are unexpectedly rebooting (PSOD) and would like to use Log Insight to quickly gauge how rampant this is across the fleet and frequency of occurence.
Unfortunately we have not been able to generate a successful query via Interactive Analysis to return any hits.
Here is a sample of actual events via the vobd.log on a given host:
2013-07-01T14:29:21.790Z: [UserLevelCorrelator] 96423176us: [esx.audit.host.boot] Host has booted.
2013-07-01T14:29:22.469Z: [UserLevelCorrelator] 97102185us: [vob.user.host.coredump] An unread host kernel core dump has been found.
Have tried setting exclusions specifically for the host name in question, free text searching for 'core dump', etc. all to no avail.
User ignorance?