Logs forwarded using Syslog and Raw protocol are missing the original source from Aria Operations for Logs (Formerly vRealize Operations)

Products

• VMware Aria Suite

Issue/Introduction

The logs forwarded from Aria Operations for Logs (Formerly vRealize Log Insight) are missing the original source and is showing the source as the IP address or hostname of Aria Operations for Logs when Syslog or Raw protocol is configured for log forwarding destinations.

Environment

Aria Operations for Logs 8.x
vRealize Log Insight 8.x

Resolution

This is expected behavior and by design when using Syslog or Raw protocol. To preserve the original source in the 'source field' the protocol must be configured with Ingestion API (default protocol). 

 

Additional Information

For reference see Add a VMware Aria Operations for Logs Log Forwarding Destination