Agents monitoring a file on a clustered disk stop sending logs

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

1. You have Aria Operations for Logs agents that are monitoring a log file on a Windows clustered disk. 

2. You stop seeing logs coming into Aria Operations for Logs, but the agents are still running fine on the boxes.

Environment

Aria Operations 8.18.x

Cause

Aria Operations for Logs Agent does not support monitoring files on the network share.

Aria Operations for Logs relies on the file handler on the Windows System that presents the files/logs to the Aria Operations for Logs Agents. Whenever a network-specific action occurs (error, failover, or simply a leader switch), the previously associated logs/files become invalid, and the file handler also becomes invalid. So the Log Agents lose the association with this handler. This results in logs not being sent to the Aria Operations for Logs.

 

Resolution

Workaround:

Restart the agent service on the targeted machines, which will retrigger log collection, and get a new valid handler. Log Agents will reestablish the association with this new file handler. Logs will be sent to the server for some time until the handler is lost again. So this is not ideal as you will need to restart agent service every time when logs are not ingested in Aria Operations for Logs.

 

Note: Users can submit a feature request for Aria Operations for Logs Agent to support collecting logs reliably on the network drive.