Duplicate ESXi Host Entries in Aria Operations for Logs: IP address and FQDN Displayed Separately

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In the Management > Hosts tab of the Aria Operations for Logs user interface, users may observe multiple entries for the same host. Typically, one entry appears with the IP address, while another shows the fully qualified domain name (FQDN).

Environment

Aria Operations for Logs 8.x

Cause

Performing a nslookup on the affected host using either the IP address or the FQDN fails to return a valid resolution.

Resolution

Ensure that DNS A and PTR records are correctly configured for the affected hosts in Active Directory.

 

To validate:
Forward DNS (A record) - From a Command Prompt or Terminal, Run and ensure it returns the correct IP address:

nslookup <hostname> 

Reverse DNS (PTR record) -  From a Command Prompt or Terminal, Run and ensure it resolves back to the correct fully qualified domain name (FQDN):

nslookup <IP-address>

 

Once all the changes are made, proceed with following the steps below to truncate the ingestion_hosts_v3 table:

- Take a  SNAPSHOT of all the nodes in the cluster.
- Log into the Primary node of Aria Operations for Logs as root via SSH or web console.
- Run the following command to log into the Cassandra database:

cqlsh-no-pass 

Note: If you experience an error while trying to access the Cassandra database then execute the following command to bypass the certificate error from cqlsh-no-pass:

sed -i 's/validate = true/validate = false/' /storage/core/loginsight/cidata/cassandra/config/cqlshrc

- Run the following command to truncate the ingestion_hosts_v3 table:

truncate logdb.ingestion_hosts_v3;

- Run the following command to exit the Cassandra database:

exit

- After truncation, hosts may temporarily disappear from the Management > Hosts tab in the Aria Operations for Logs UI. Allow up to 5 minutes for the system to automatically rediscover and repopulate the host list.

Additional Information

To validate the status of truncation execute the following command: lisuper@cqlsh> SELECT * FROM logdb.ingestion_hosts_v3;
Refer: Multiple Inactive ESXi Host Email Alerts Triggered by Aria Operations for Logs Cluster