Importing a large number of archived logs into Aria Operations for Logs

Products

• VMware Aria Suite

Issue/Introduction

This article provides a workaround for importing a large number of archived logs back to the VMware Aria Operations for Logs cluster when the loginsight-importer tool fails.

Symptoms:

• You are importing a large number of archived events back into VMware Aria Operations for Logs (formerly known as vRealize Log Insight)
• The standard loginsight-importer tool fails, and you see log messages similar to the below in /var/log/loginsight/importer.log:

failed to import parsed messages from 0 to 1000

Cause

This issue occurs when the loginsight-importer tool is reading a high number of log events faster than they can be processed, which can result in drops of newly incoming logs.

Resolution

This is a known issue affecting VMware Aria Operations for Logs (formerly known as vRealize Log Insight), there is no resolution at this time.  Please subscribe to this article to be informed when updates are published.

Workaround:
To workaround the issue, import log blobs one by one by running the following command:

find archive_location -name '*.blob' -exec /usr/lib/loginsight/application/bin/loginsight repository import {} \;

Note: Replace archive_location with the directory which contains archived log blobs. All *.blob files found inside the archive_location hierarchy will be imported into VMware Aria Operations for Logs.