Aria Operations for Logs (Formerly vRealize Log Insight) cluster instability where primary node Loginsight services are flapping.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Aria Operations for Logs primary node becomes unavailable every few minutes.  
• Uptime shows that the node is restarting and status intermittently shows as disconnected when navigating to Management → Cluster in Aria Operations for Logs UI
• Loginsight services are flapping between active(running) and inactive (dead) when running the following command on a ssh session as root to the primary node:

  systemctl status loginsight

• Aria Operations primary node shows high memory usage
• /storage/core/loginsight/var/runtime.log shows errors similar to below extract:

[2024-05-24 10:21:31.468+0000] ["LogSearchers-thread-55"/###.###.###.### ERROR] [com.vmware.loginsight.daemon.StrataServiceFailureHandler]
[Fatal error:]
java.lang.OutOfMemoryError: Requested array size exceeds VM limit
        at org.apache.lucene.util.ArrayUtil.grow(ArrayUtil.java:338) ~[lucene-core-4.1.0.jar:4.1.0 ###### - sarowe - 2013-01-16 17:16:50]
        at org.apache.lucene.util.BytesRef.grow(BytesRef.java:225) ~[lucene-core-4.1.0.jar:4.1.0 ###### - sarowe - 2013-01-16 17:16:50]
        at org.apache.lucene.codecs.BlockTreeTermsReader$FieldReader$SegmentTermsEnum$Frame.nextNonLeaf(BlockTreeTermsReader.java:2488) ~[lucene

Environment

Aria Operations for Logs (Formerly vRealize Log Insight) 8.x

Resolution

The workaround for this issue requires truncation of specific tables in the database.

For assistance, contact Broadcom Support and note this Article ID (372700) in the problem description. For more information, see Creating and managing Broadcom support cases

Additional Information

Aria Operations for Logs UI intermittently not accessible with nodes uptime flapping 

Aria Operations for Logs nodes are rebooting intermittently 

Unable to access one node of Aria Operations for Logs cluster