VMware Aria Automation appliance /dev/mapper/logs_vg-log file system shows as 100% used.

Products

• VMware Aria Suite

Issue/Introduction

Explains the cause on why /dev/mapper/logs_vg-log is getting filled up

Symptoms:

/dev/mapper/logs_vg-log shows 100% utilized as audit logs keeps growing rapidly

Environment

VMware vRealize Automation 8.x

Cause

The audit logs expand rapidly due to the enabled audit service/logging, potentially leading to excessive space consumption in the /var/log partition.

Resolution

• Check if auditd service is enabled by running the command on vRA appliance

systemctl status auditd

• If you find it enabled, you can disable it

systemctl disable auditd

 

• Reboot vRA nodes.
• Audit logs logging will be stopped

Additional Information

Impact/Risks:

/dev/mapper/logs_vg-log will fill up rapidly