False positive alerts for absent vSAN components in Aria Operations for Logs

Products

• VMware vSAN

Issue/Introduction

Multiple repeated alerts are seen in Aria Operations for Logs for absent vSAN UUIDs, even though all vSAN data is healthy in the Skyline Health check in vCenter.

Environment

VMware Aria Operations for Logs

Cause

This may occur when there has been a previous situation where some vSAN objects were in a reduced availability state - e.g. a disk failure, an unexpected ESXi host reboot - and then recovered. While the vSAN objects are then healthy again in vSAN, Aria Operations for Logs may still retain a record of the previous object state, which could lead certain Aria queries to continue to trigger alerts for these vSAN objects.

Resolution

Broadcom Engineering are working on a change to a future content pack for Aria Operations for Logs to modify the log pattern for absent component events, so these false/historic positives will no longer trigger alerts.

Additional Information

For the moment, the only viable workaround to prevent these alerts is to disable the specific query.