"vCenter task and event collection failed for the following hosts" system alert received in Aria operation for logs

Products

• VMware Aria Suite

Issue/Introduction

 

• Aria operations for Logs  receives a daily system alert stating: vCenter task and event collection failed for the following hosts
• You see a similar message in /storage/core/loginsight/var/plugins/vsphere/li-vsphere.log stating:

["ScheduledPluginServiceScheduledTask-thread-1"/##.###.##.## ERROR] [com.vmware.loginsight.vsphere.events.VimEventMonitor] [[https://vCenterFQDN/sdk] Failed to delete /storage/core/loginsight/var/plugins/vsphere/vCenterFQDN]

Environment

Aria Operations for logs 8.X

Cause

Files named after the vCenter FQDN in the /storage/core/loginsight/var/plugins/vsphere directory maintain information about the vCenters that are being monitored by the vSphere integration.
The timestamp details when the latest event was collected from the vCenter.Sometimes, after an upgrade, Aria Operations for logs is unable to properly update the pre-existing vCenter files from the /storage/core/loginsight/var/plugins/vsphere directory, which will result in missed collections.

Resolution

To resolve this issue, manually delete the vCenter associated files for collections to resume.  To do so, complete the following steps on each node in the vRealize Log Insight cluster.

1. Log into the Aria operations for logs node as root via SSH or Console.
2. Navigate to the /storage/core/loginsight/var/plugins/vsphere/ directory.
3. Manually delete all files referring to the vCenter name listed in the system alert.
4. Restart the Log Insight service:

service loginsight restart

5. Repeat steps 1-4 on all Aria operations for logs nodes in the cluster.

A new file will be generated for the vCenter and Aria operations for logs will continue with the collection of vCenter events and tasks.