Not able to create new logs forwarding in VMware Aria Operations for Logs getting ERROR: "Unable to save target : Request failed 400: Bad Request"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

You have multiple Log forwarding destinations saved and already working in Aria Operations for Logs 8.18.x.

However when you try to add a new one you are greeted with ERROR: "Unable to save target  : Request failed 400: Bad Request"

Rebooting the appliances does not resolve the issue

Environment

Aria Operations for Logs 8.18.x

Cause

Starting from version 8.18 GA the default maximum limit for log forwarders is set at 10

Resolution

Aria Operations for Logs admin can manually increase the limit to resolve this issue.

As mentioned in the KB article Configure "The Number Of Log Forwarders" increased the limit of forwarders up to 20 per cluster :

Please Note: The recommended maximum of log forwarders per Log Insight instance is 20. Configurations having more than 20 log forwarders are unsupported. 

 

Workaround steps to increase the limit:

1. Connect to the Aria Operations for Logs swagger UI through URL "https://<Operations_for_Logs_FQDN/IP>/rest-api"
2. Obtain the Bearer token value by following the KB article Obtain a sessionId to Authorize APIs in the Swagger UI
3. Update the limit from 10 to desired value for 'max-log-forwarder-count' by executing below PATCH API call
   
4. Verify that the limit is changed by executing the GET API call.
   

Additional Information

Each forwarder can affect the performance of the cluster and has the potential to impact the ingestion rate. It was observed that there are cases where complex forwarders affect ingestion rate and causes accumulation of disk blocks.

Review resolution section of KB article Configure "The Number Of Log Forwarders" increased the limit of forwarders up to 20 per cluster. for  scenarios that do not impact the ingestion negatively. Consider them when configuring forwarders.