Duplicated logs collected with default agent configuration of vSphere Content Pack

Products

• VMware Aria Suite

Issue/Introduction

Duplicate logs from /var/log/vmware/vpostgres/postgresql.log-01 in vCenter Server were collected by vSphere Content Pack agent

Environment

Aria Operations for Logs

Cause

The default agent configurations of the vSphere Content Pack in Aria Operations for Logs are as below:

[filelog|vsphere7_0-linux-vpostgres]
directory=/var/log/vmware/vpostgres
include=*.log*;
exclude=*.gz;*.stderr;*.stdout;*-gc.*;
event_marker=^(\========== Start of Postgres status query|# Date:|\d{4}-\d{2}-\d{2})
tags={"vmw_product":"vcenter"}

When the postgresql.log rotates, postgresql.log-01 could be captured too by the Aria Operations for Logs Agent, that is resulting in duplicate logs.

 

Resolution

To avoid duplication, change this setting of agent configuration  

include=*.log*;

to

include=*.log;