Importing a large number of archived logs into Aria Operations for Logs
book
Article ID: 315917
calendar_today
Updated On:
Products
VMware Aria Suite
Issue/Introduction
This article provides a workaround for importing a large number of archived logs back to the VMware Aria Operations for Logs cluster when the loginsight-importer tool fails.
Symptoms:
You are importing a large number of archived events back into VMware Aria Operations for Logs (formerly known as vRealize Log Insight)
The standard loginsight-importer tool fails, and you see log messages similar to the below in /var/log/loginsight/importer.log:
failed to import parsed messages from 0 to 1000
Cause
This issue occurs when the loginsight-importer tool is reading a high number of log events faster than they can be processed, which can result in drops of newly incoming logs.
Resolution
This is a known issue affecting VMware Aria Operations for Logs (formerly known as vRealize Log Insight), there is no resolution at this time. Please subscribe to this article to be informed when updates are published.
Workaround: To workaround the issue, import log blobs one by one by running the following command:
Note: Replace archive_location with the directory which contains archived log blobs. All *.blob files found inside the archive_location hierarchy will be imported into VMware Aria Operations for Logs.