Aria Operations for Logs (Formerly vRealize Log Insight) is not able to collect logs from some of the vCenter servers

Products

• VMware Aria Suite

Issue/Introduction

To fix timeout error causing failure of vCenter logs collection.

Symptoms:

• VMware Aria Operations for Logs is integrated with many vCenter servers, out of which it cannot collect logs from a few vCenter servers.
• The password is correct and the connection is successful, but still collection failed status is visible.
• A similar error will be visible in the /storage/core/loginsight/var/plugins/vsphere/li-vsphere.log:

  ["ScheduledPluginServiceScheduledTask-thread-1"/x.x.x.x ERROR] [com.vmware.loginsight.scheduled.ScheduledPluginService] [Timeout while waiting for WCP events from 'vcenter.vcloudb.lan', timeout=600000 millis. vCenter can't complete requested range in time. Increasing vsphere's config event-collection-timeout-millis may mitigate the problem but that may introduce delays to other vCenter collectors.]

Environment

VMware vRealize Log Insight 8.x

Aria Operaitons for Logs 8.x

Cause

The default timeout value is set to "600000 milliseconds". Due to too many events at once, some logs will be missed. In order to prevent losing events, the timeout value should be increased.

Resolution

This can be fixed by increasing the timeout value by following the below steps.

Note: Take a snapshot of each Aria Operations for Logs appliance in the cluster or backup of the config file before making the changes.

Steps:

1. Open https://<log_insight_fqdn>/internal/config in a new browser window.
2. Login using admin credentials.
3. Add the below line under the <vsphere> tag in this format:

   <event-collection-timeout-millis value="1200000" />

   Sample:
   
   

4. Save the settings.
5. Reload the Aria Operations for Logs UI and log in again.
6. The collection will start happening after a while.

 

If this method does not work you will need to update the 'loginsight-config.xml#xxx'  file on the Aria Operations for Logs appliance.

1. Open an SSH session to each Aria Operations for Logs node.
2. Navigate to the config directory

   cd /storage/core/loginsight/config

3. Make a backup of the most recent config.xml file;

   cp loginsight-config.xml#xxx loginsight-config.xml#xxx.old

4. Edit the config.xml to include the event-collection property under the <vsphere> tag

   vi loginsight-config.xml#xxx
   <event-collection-timeout-millis value="1200000" />

5. Restart the Aria Operations for Logs service

   service loginsight restart

6. After the restart, the collections should begin after some time.

Additional Information

Impact/Risks:
Logs will not be collected for some of the vCenters and the collection status will show an Error.