Aria Operations for Logs (Formerly vRealize Log Insight) is not able to collect logs from some of the vCenter servers

Products

• VMware Aria Suite

Issue/Introduction

To fix timeout error causing failure of vCenter logs collection.

Symptoms:

• vRealize Log Insight is integrated with many vCenter servers, out of which it cannot collect logs from a few vCenter servers.
• The password is correct and the connection is successful, but still collection failed status is visible.
• A similar error will be visible in the /storage/core/loginsight/var/plugins/vsphere/li-vsphere.log:

"[2022-07-04 10:22:08.099+0000] ["ScheduledPluginServiceScheduledTask-thread-1"/10.92.6.8 ERROR] [com.vmware.loginsight.scheduled.ScheduledPluginService] [Timeout while waiting for WCP events from 'vcenter.vcloudb.lan', timeout=600000 millis. vCenter can't complete requested range in time. Increasing vsphere's config event-collection-timeout-millis may mitigate the problem but that may introduce delays to other vCenter collectors.]"

Environment

VMware vRealize Log Insight 8.x

Aria Operaitons for Logs 8.x

Cause

• The default timeout value is set to "600000 milliseconds". Due to too many events at once, some logs will be missed. In order to prevent losing events, the timeout value should be increased.
  
  

Resolution

This can be fixed by increasing the timeout value by following the below steps.

Note: Take a snapshot of the each Log Insight appliance in the cluster or backup of the config file before making the changes.

Steps:

1. Open https://<log_insight_fqdn>/internal/config in a new browser window.
2. Login using admin credentials.
3. Add the below line under the <vsphere> tag in this format:

<event-collection-timeout-millis value="1200000" />


Note: The above example is taken from a lab, so your values will differ

4. Save the settings.
5. Reload the Log Insight UI and log in again.
6. The collection will start happening after a while.

If this method does not work you will need to update the 'loginsight-config.xml#xxx'  file on the Operations for Logs appliance.

1. 1. Open an SSH session to each Operations for Logs.
   2. Navigate to the config directory;

      • cd /storage/core/loginsight/config

   3. Make a backup of the most recent config.xml file;

      • cp loginsight-config.xml#xxx loginsight-config.xml#xxx.old

   4. Edit the config.xml to include the event-collection property under the <vsphere> tag;

      • vi loginsight-config.xml#xxx

      • <event-collection-timeout-millis value="1200000" />

   5. Restart the Operations for Logs service;

      • service loginsight restart

   6. After the restart, the collections should begin after some time.

Additional Information

Impact/Risks:
Logs will not be collected for some of the vCenters and the collection status will show an Error.