Questions and Answers for Diagnostics for VMware Cloud Foundation

Products

• VMware Aria Operations 8.x

Issue/Introduction

Diagnostics for VMware Cloud Foundation is a centralized platform that monitors the overall operational status of the VMware Cloud Foundation software stack.

It is a self-service platform that helps you analyze and troubleshoot the components of VMware Cloud Foundation, including vCenter, ESXi, vSAN, capabilities such as vSphere vMotion, snapshots, VM provisioning, and other issues including security advisories and certificates. As an Infrastructure admin, you can monitor the operational state of your environment using diagnostics findings and custom pages. Diagnostics validates if your environment is up-to-date with the important VMware Security Advisories" -> "Diagnostics validates if your environment is impacted by important VMware Security Advisories

For more information please visit - What is Diagnostics for VMware Cloud Foundation

Resolution

Q: I upgraded to VMware Aria Operations 8.18. Why do I not see any of my Skyline Advisor findings in Diagnostics?

A: Diagnostics on VMware Aria Operations 8.18 has Skyline Advisor finding only on patch based findings. If you do not have any Skyline Upgrade findings in Skyline Advisor, you will not have any findings in Diagnostics as well. 

 

Q: I updated my VCF environment, but I still see Property findings. How do I resolve this?

A: Reestablish the cloud account integrations. The certificate or service account may need to be reconnected to gather new product information into Operations. 

 

Q: Why do we not see all the VMSAs in Diagnostics as in Skyline Advisor?

A: There are 16 VMSAs in the VMware Aria Operations 8.18 release. VMSAs were not ported over if they were Low severity, complex code (example checking VMs for USB controllers or if SLP is enabled on a host), or the product is not with-in the VCF 5.2 Bill of Materials. There are additional VMSAs added to 8.18.2 - https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/Chunk2029420434.html

 

Q: Skyline Advisor had monthly findings updates, when will we see that in Diagnostics?

A: There are no plans to release new findings on a monthly cadence at this time. In future release, we are considering increasing the frequency of findings releases.

 

Q: Do I need to have a SDDC Manager in my environment for Diagnostics to work?

A: No, you only need vSphere in your environment for Diagnostics to work.  You need to upgrade to VMware Aria Operations 8.18 and the diagnostic module will be installed. 

 

Q: How often are the data updates for Findings in Diagnostics?

A: In the VMware Aria Operations 8.18 diagnostics, findings are computed by rules and log scans. Rules process data collected by Aria Operations while log scans process log statements collected into Arial Log Insight. The rule data is collected by the VMware Aria Operations product management packs. By default, they run every 5 minutes. For log, log insight supports streaming logs from products to log insight. New log statements are available to be scanned shortly after they are received by log insight. 

 

Q: What License level makes the "Diagnostics " section available to customers?

A: There is no license dependency. This works on both VVF and VCF.

 

Q: Are any public or private APIs endpoints available for the new diagnostics feature in 8.18? Will they be coming in 8.18.0 HF1?

A: There are no API endpoints available for diagnostics in VMware Aria Operations 8.18. They may be added in a forthcoming release. 

 

Q: Diagnostics for VMware Cloud Foundation today does not require internet connectivity? Is there a plan to always keep it this way or will this change over time?

A: Before we answer this question, let's review the components of the diagnostic solution. First, there is the logic that evaluates a customer's environment to determine if health or known issues are present. Second, when an issue is found, in addition to providing product information, we reference KBs. And, third, the set of diagnostic signatures is designed to be updated after a product release. Now to answer the question about requiring internet connectivity. (1) the evaluation will never require internet connectivity, while (2) access to KBs will always, since we have no plans to package KBs with VCF operations. As for updating the diagnostic signatures, we will publish these as product patches which will need to be downloaded.

 

Q: Will customers have to download MPs to get updates for new findings?

A:  Customers will need to apply a VMware Aria Operations patch release. The patch release may include updates to other modules or just to the diagnostics module. 

 

Q: We do not see any configuration rules in Diagnostics, is that by design? When will we see configuration rules in Diagnostics?

A: These are being considered for a future release. 

 

Q: Ability to create and auto-upload support bundles to SRs? Many customers DO NOT have a way to upload large files and the Skyline service provided a streamlined way to do so.

A: This capability is being considered for a future release. 

 

Q: Why are rule-based findings periodically evaluated but not log-based ones?

A: Log-based findings are not automatically evaluated in Aria Operations 8.18 to eliminate another load on the Aria Operations for Logs instance integrated with Aria Operations. The release introduces new load patterns on Aria Operations for Logs and we seek customer feedback to understand the impact on day to day use of Aria Operations for Logs. Diagnostics, Audit Events, and vMotion monitoring query data from Operations for Logs. To use these features requires customers to integrate Aria Operations with a single Aria Operations for Logs instance, and collect all logs and vSphere events into this instance for the environments managed by the Operations instance. Also, the time taken to run the queries for these features depends on the amount of data and logs ingested into Aria Operations for Logs.

 

Q: Why would 'active' Findings only be visible for 24 hours? If the property that triggered the Finding is still incorrect, or there has not been any corrective action detected based on log-triggered Findings, why would we hide the fact that an issue (finding) may still be valid in the customer's environment?

A: An active finding is reported if the issue is considered to be still active. Rule and log based findings have different definitions of "active" because of the complexity of determining when a log-based finding no longer applies. Generally, log statements are not issued in GA builds when a condition has cleared. A rule-based finding is still active if the finding evaluated to TRUE when the rule was last evaluated. Otherwise the finding is deleted. Rules are evaluated every four hours. A log based finding is considered to be still active if the last manually-initiated scan reported an occurrence of the signature, and the most recent occurrence was less than 36 hours ago. An active scan covers the last 24 hours and any log-based findings detected within that 24 hour window are retained for 36 hours. 36 hours was used to give the user time to evaluate the findings of a log-based scan when those findings occurred more than 20 hours ago. An example may further clarify the treatment of log-based findings. Suppose a log signature was issued by a vCenter Server at a time T and an Active log scan for this signature was run by a user at time T+23 hours. This finding will be reported for the next 36-23 = 13 hours. However, if a user then re-ran the Active scan at T+25 hours for the same vCenter Server, the signature won’t be found in the past 24 hours, and the finding will be deleted. 

 

Q: Why are active Findings not also visible in Ops Alerts nor object Alert tabs?

A; They are not included to avoid generating many alerts, which will confuse users, and hide other issues. In a future release, we will enable alerting. Findings are represented in Operations as events with multiple parameters. The symptom framework cannot evaluate these parameters. 

 

Q: Historical analysis - how much Findings history will Ops\Logs store / provide? When will we add the ability to export a Historical Findings run to XLS/PDF? Will there be API access to 'Findings'?

A: There are two types of history, findings that were found in the past, and findings that are found by scanning logs for a period in the past. For the first type, in VMware Aria Operations 8.18., operations does not offer any such report - e.g., there is no time-based view on past findings. For the second type, the history is based on the retention period of logs in Aria Operations for Logs. The retention period is controlled by users.

 

Q:  Are there any plans to be able to export data for Skyline findings in VMware Aria 8.18?  No data export options.

A: This capability is being considered for a future release. 

 

Q: Where can I see the list of the Findings which are a part of Diagnostics for VMware Cloud Foundation 5.2?

A:  Please review the following link. https://knowledge.broadcom.com/external/article/371661/diagnostics-for-vmware-cloud-foundation.html

 

Q: Is there a way to hide a finding?

A: Currently, there is no feature to hide a finding. You can disable a finding by following the steps outlined in the following KB: https://knowledge.broadcom.com/external/article/369791

 

Q: Some findings in Diagnostics appear to be different from what is in Skyline Advisor currently. Is this expected?

A: Diagnostics is a combination of findings ported over from Skyline Advisor and Skyline Health Diagnostics. During the process of porting findings over, we reviewed if it is better to have a log based signature or a property based signature if a KB existed in both solutions. In certain situations for example Article 318221 (KB 92962) the issue is better identified in the logs then in object property, so the finding came from Skyline Health Diagnostics instead of Skyline Advisor.