Duplicate ESXi Host Entries in Aria Operations for Logs: Shortname and FQDN Displayed Separately

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In the Management > Hosts tab of the Aria Operations for Logs user interface, users may observe multiple entries for the same host. Typically, one entry appears with the short hostname, while another shows the fully qualified domain name (FQDN).

Environment

Aria Operations for Logs 8.x

Cause

This behavior is typically observed when syslog messages are sent from a host using only the short hostname in the hostname portion of the syslog header, rather than the Fully Qualified Domain Name (FQDN).

Resolution

Before proceeding with the steps below, ensure that DNS A and PTR records are correctly configured for the affected hosts in Active Directory.

 

To validate:
Forward DNS (A record) - From a Command Prompt or Terminal, Run and ensure it returns the correct IP address:

nslookup <hostname>

 Reverse DNS (PTR record) -  From a Command Prompt or Terminal, Run and ensure it resolves back to the correct fully qualified domain name (FQDN): 

nslookup <IP-address>

 

After the aforementioned DNS record updates are confirmed, follow the steps below:

- Login as root to the affected ESXi Host via SSH.
- Run the following command to verify that the hostname, domain name, and FQDN are correctly returned:

esxcli system hostname get

 

-If any of these values are missing, proceed with the steps outlined below:
  - Set the domain name on all affected hosts using the following command:

esxcli system hostname set --domain=<domain_name>

  - Set the hostname (FQDN) on all affected hosts using the following command:

esxcli system hostname set --fqdn=<FQDN>

  - Set the hostname on all affected hosts using the following command:

esxcli system hostname set --host=<hostname>

  - Confirm that the hostname, domain name, and FQDN are properly set by executing the following command:

esxcli system hostname get

 

 

Once all the values are consistent, proceed with following the steps below to truncate the ingestion_hosts_v3 table:

- Take a SNAPSHOT of all the nodes in the cluster.
- Log into the Primary node of Aria Operations for Logs as root via SSH or web console.
- Run the following command to log into the Cassandra database:

cqlsh-no-pass

Note: If you experience an error while trying to access Cassandra database then execute the following command to bypass the certificate error from cqlsh-no-pass:

sed -i 's/validate = true/validate = false/' /storage/core/loginsight/cidata/cassandra/config/cqlshrc

 - Run the following command to truncate the ingestion_hosts_v3 table:

truncate logdb.ingestion_hosts_v3;

 - Run the following command to exit the Cassandra database: 

exit

 

- After truncation, hosts may temporarily disappear from the Management > Hosts tab in the Aria Operations for Logs UI. Allow up to 5 minutes for the system to automatically rediscover and repopulate the host list.

Additional Information

To validate the status of truncation execute the following command: lisuper@cqlsh> SELECT * FROM logdb.ingestion_hosts_v3;
Refer: Multiple Inactive ESXi Host Email Alerts Triggered by Aria Operations for Logs Cluster