Incorrect tag values applied to hosts in vRealize Log Insight

Products

• VMware Aria Suite

Issue/Introduction

Symptoms:

• Multiple vCenters are logging to a single vRealize Log Insight instance through vSphere integration.
• ESXi Hosts in the vCenters have tags assigned to them, designating their environment.

Example: env=vc1 or env=vc2.

• After migration of a host  from one vCenter to another vCenter, the host shows the incorrect tag value

Example: Tag env=vc1 is shown, when the host is in vCenter 2.

Cause

The mapping information stored in Cassandra contains both old and new mappings after an ESXi host is migrated from one VC to another, and when assigning the tag the old mapping info is used.

Resolution

This is a known issue impacting vRealize Log Insight.  Currently, there is no resolution.

Workaround:
To workaround this issue, remove the old mapping information from the Cassandra table.

1. Log into the Primary node as root via SSH or Console, pressing ALT+F1 in a Console to log in.
2. Follow How to Access the Cassandra Database in vRealize Log Insight (57901) to log into the Cassandra database.
3. Run the following command to display information associated with the problematic ESXi host in the inventory.inv_clients_v2 table:

select * from inventory.inv_clients_v2 WHERE hostname='problematic_host' ALLOW FILTERING;

Note: Replace problematic_host with the hostname of the ESXi host showing the incorrect tag value.

4. From the displayed filtered table find the row which contains the old tag information in the id column and remove it using following command:

DELETE from inventory.inv_clients_v2 WHERE id='id' AND bucket=bucket;

Note: Replace id with the id of the row, and bucket with the bucket value of the row from the displayed filtered table.

5. Repeat steps 3 and 4 for all other problematic ESXi hosts.

After this, newly arrived ESXi logs will display the correct tag.

Additional Information

Impact/Risks:
Modifying the database can cause damage if done incorrectly.
It is recommended to take a snapshot or backup before proceeding with the workaround.