Aria Operations for Networks not forwarding Syslog Data where configured.

Products

• VCF Operations for Networks

Issue/Introduction

Aria Operations for Networks not forwarding Syslog Data but completes a Send Test Log

Logs from Collector under /var/log/arkin/collector/latest_error.log shows before error.

2024-07-23T12:04:53.517Z INFO audit.service.AuditSysLogService audit-service-exec-0 sendToSyslogFromPlatform:82 Audit event send for customer Id: 12619 to remote syslog server: [2024-07-23T12:04:53.53Z]  -  -   Web-Application  LOGIN  admin@local  SUCCESS  {props_change:[]}
2024-07-23 12:04:53,517 audit-service-exec-0 ERROR Attempted to append to non-started appender vRNISyslogLogger

Environment

VMware vRealize Network Insight 6.9
Aria Operations for Networks 6.10.0
Aria Operations for Networks 6.11.0
Aria Operations for Networks 6.12.0
Aria Operations for Networks 6.12.1
Aria Operations for Networks 6.13.0
Aria Operations for Networks 6.14.0

Cause

It is possible your syslog server is not responding to ping test from the Aria Operations for Networks ping test. Which will prevent authentication.
Ping/ICMP is disabled.

Resolution

1. Check if UDP Port 514 is enabled.
2. During system log configuration, to test the configuration Send Test log is needed. This will ping the system Log to once establish the connectivity for configuration. 
3. Check if Ping/ICMP service on your syslog server and ensure it is enabled and running.
4. If it is disabled, you can enable temporarily for the platform to make the initial connection and start sending data then you may disable it again if needed.