Log forwarding not sending tags in Aria Operations for Logs

search cancel

book

calendar_today

VCF Operations/Automation (formerly VMware Aria Suite)

The syslog destination is not receiving logs with tags after configuring Log Forwarding in Aria Operations for Logs.

Install tcpdump in the environment to verify that Aria Operations for Logs is transmitting tags correctly:

SSH to the primary node of Aria Operations for Logs with the root user
If Aria Operations for Logs has access to the internet, run the command below to install tcpdump:
```
tdnf install tcpdump
```
Follow these steps to install tcpdump if the Aria Operations for Logs appliance does not have internet access:
1. Locate and download the tcpdump package from the Broadcom Photon OS 4.0 updates repository https://packages.broadcom.com/photon/4.0/photon_updates_4.0_x86_64/x86_64/
2. Upload the downloaded tcpdump package to the /tmp directory on the Aria Operations for Logs primary node using WinSCP
3. SSH to the primary node of Aria Operations for Logs with the root user
4. Install the package locally using tdnf command:
```
tdnf install /tmp/<package_name>.rpm
```
To verify log forwarding to the syslog endpoint, run the following command to generate a packet capture:
```
tcpdump -v -s 0 -A dst <syslogserver_ipaddress> and dst port 514
```
Leave the packet capture active for a short period to ensure the forwarding rule has time to trigger.
Terminate the packet capture using the Ctrl+C keyboard shortcut.
Inspect the capture using a packet analyzing tool; if the tags are configured on the Log Forwarding page under Log Management, they will be visible within the log events captured by tcpdump.
Once troubleshooting is complete, uninstall tcpdump from the environment by running the command:
```
rpm -e tcpdump
```

To access the Broadcom Photon OS updates repository, refer to: https://packages.broadcom.com/photon/

Run the following command to check the Photon OS version on the appliance:

cat /etc/photon-release

thumb_up Yes

thumb_down No