Diagnose Log Ingestion

Products

• VMware Aria Suite

Issue/Introduction

Aria Operations for Logs Content Packs show empty dashboards.

Environment

Aria Operations for Logs - All versions

vRealize Log Insight - All versions

Cause

• Aria Operations for Logs not receiving logs from Aria Operations properly
• Aria Operations for Logs not extracting data from logs received, properly

Resolution

Aria Operations for logs relies on Environment to push logs to it, rather than pulling the logs from the environments.

• Confirm that Logs are actually reaching Aria Operations for Logs by going to the Logs Explorer.
  • Do a search for logs by filtering by hostname and enter the name of the VM you're looking for. (In this example, one of the Aria Operations Cluster VMs.)
  • Just putting in the VM name in the search or using the default "test" filter may return false positive or false negative which would lead you in the wrong diagnostics direction.
• If there are no Logs Found then you need to check the configuration for the LI-agent.ini and the LI-agent-effective.ini to make sure the environment is configured to send the logs properly to Aria Operations for Logs. 
  • LI-agent-effective.ini is the file currently being used by the li-agent.
  • Only make changes to the LI-agent.ini file. This will update the LI-agent-effective.ini automatically.
  • Configuring VMware Aria Operations for Logs Agents
• If you are using a CFAPI configuration and are not using SSL, then go to the Configuration->SSL page and make sure the "Require SSL Connection" option is turned off. Otherwise, Aria Operations for Logs will reject the logs being sent to it.
  • You can check your liagent.ini file to determine what protocol is being used to send the logs to Aria Operations for Logs.
    • Look for the entry:
      • ; Protocol can be cfapi (Log Insight REST API), syslog, syslog_udp. Default:
      • proto=cfapi
    • liagent.ini location:
      • Linux:  /var/lib/loginsight-agent/
      • Windows: %ProgramData%\VMware\Log Insight Agent
      • Define Log Details Level in the VMware Aria Operations for Logs Agents
        
  • In the case of Aria Operations you can look at the "Log Forwarding" settings in Administration for the configuration page.