When forwarding logs, tags are not consistently applied to all events.

Products

• VMware Aria Suite

Issue/Introduction

When forwarding the events to telemetry/Splunk some of the events are not tagged as expected but forwarded to the endpoint.

Environment

Aria Operations for logs 8.18.0

Aria Operations for logs 8.18.x

Cause

Tags cannot be applied to source logs (Injection to Aria Operations for logs) that do not comply with RFC standards.

Resolution

The code fix will be made available in the next Major release.
Kindly follow the steps below to apply the fix.

Steps for Aria Operations for logs 8.18.0

Steps for Aria Operations for logs 8.18.x

Note: It is recommended to take a snapshot before following the action plan below:

Action plan to be followed only for Version 8.18.0:

• Putty into the Master node as root.
• Backup the Jar files by running the below command:

  # cp /usr/lib/loginsight/application/3rd_party/apache-tomcat/webapps/ROOT/WEB-INF/lib/ingestion-service.jar /root/ingestion-service-tomcat.jar.copy
  # cp /usr/lib/loginsight/application/lib/ingestion-service.jar /root/ingestion-service.jar.copy

• Download the Attached JAR file named 'ingestion-service-8.18.0.jar'.
• Copy the file to /tmp directory using winscp.
• Replace the file in both the directories using the below command

  # cp /tmp/ingestion-service-8.18.0.jar /usr/lib/loginsight/application/3rd_party/apache-tomcat/webapps/ROOT/WEB-INF/lib/ingestion-service.jar
  # cp /tmp/ingestion-service-8.18.0.jar /usr/lib/loginsight/application/lib/ingestion-service.jar

• Restart the Loginsight Service.

  # service loginsight restart

• Follow the above steps and replace the files on the the worker nodes.

 

Action plan to be followed only for Version 8.18.x (8.18.1, 8.18.2, 8.18.3):

• Putty into the Master node as root.
• Backup the Jar files by running the below command:

  # cp /usr/lib/loginsight/application/3rd_party/apache-tomcat/webapps/ROOT/WEB-INF/lib/ingestion-service.jar /root/ingestion-service-tomcat.jar.copy
  # cp /usr/lib/loginsight/application/lib/ingestion-service.jar /root/ingestion-service.jar.copy

• Download the Attached JAR file named 'ingestion-service-8.18.x.jar'.
• Copy the file to /tmp directory using winscp.
• Replace the file in both the directories using the below command

  # cp /tmp/ingestion-service-8.18.x.jar /usr/lib/loginsight/application/3rd_party/apache-tomcat/webapps/ROOT/WEB-INF/lib/ingestion-service.jar
  # cp /tmp/ingestion-service-8.18.x.jar /usr/lib/loginsight/application/lib/ingestion-service.jar

• Restart the Loginsight Service

  # service loginsight restart

• Follow the above steps and replace the files on the the worker nodes.