Events displayed in Explore Logs are truncated - Aria Operations for Logs

Products

• VMware Aria Suite

Issue/Introduction

• The relevant log file on the host contains the complete error message event.
• The host sending logs to Aria Operations for Logs is configured to use UDP.
• The actual log event is of size greater than ~480 bytes, while in Explore Logs, only ~475 bytes are displayed from the message.
• The hosts Syslog.global.remoteHost.maxMsgLen setting has been increased as per ESXi Syslog Options.

 

Environment

Aria Operations for Logs 8.x

Cause

As per the description of Syslog.global.remoteHost.maxMsgLen in ESXi Syslog Options:

This setting does not affect the UDP protocol. RFC 5426 specifies the UDP message lengths that can be safely accepted at 480 bytes for IPV4 and 1180 bytes for IPV6.

Resolution

In order for the host to transmit the complete error message event, reconfigure the host to use TCP instead.

1. Login to Aria Operations for Logs
2. Browse to Integrations >> vSphere
3. Edit the integration and reconfigure the host to use TCP instead of UDP.