Diagnose Log Ingestion
search cancel

Diagnose Log Ingestion

book

Article ID: 372664

calendar_today

Updated On:

Products

VMware Aria Suite

Issue/Introduction

Aria Operations for Logs Content Packs show empty dashboards.

Environment

Aria Operations for Logs - All versions

vRealize Log Insight - All versions

Cause

  • Aria Operations for Logs not receiving logs from Aria Operations properly
  • Aria Operations for Logs not extracting data from logs received, properly

Resolution

Aria Operations for logs relies on Environment to push logs to it, rather than pulling the logs from the environments.

  • Confirm that Logs are actually reaching Aria Operations for Logs by going to the Logs Explorer.
    • Do a search for logs by filtering by hostname and enter the name of the VM you're looking for. (In this example, one of the Aria Operations Cluster VMs.)
    • Just putting in the VM name in the search or using the default "test" filter may return false positive or false negative which would lead you in the wrong diagnostics direction.
  • If there are no Logs Found then you need to check the configuration for the LI-agent.ini and the LI-agent-effective.ini to make sure the environment is configured to send the logs properly to Aria Operations for Logs. 
  • If you are using a CFAPI configuration and are not using SSL, then go to the Configuration->SSL page and make sure the "Require SSL Connection" option is turned off. Otherwise, Aria Operations for Logs will reject the logs being sent to it.
    • You can check your liagent.ini file to determine what protocol is being used to send the logs to Aria Operations for Logs.
    • In the case of Aria Operations you can look at the "Log Forwarding" settings in Administration for the configuration page.