Hosts configured to send logs to Aria Operations for Logs show errors in vCenter indicating "<hostname> lost N log messages"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Hosts were previously configured to send logs to the Aria Operations for Logs VIP
• After reconfiguring the hosts to use the IP of the Primary Aria Operations for Logs node, the VIP IP is still present in syslog configuration on the hosts
• You are using Cisco ACI and have not changed the setting to allow Cisco ACI to work properly with the Aria Operations for Logs VIP. See: Cisco ACI based environment conflicting with the VIP in Aria Operations for Logs

Environment

Aria Operations for Logs 8.18.x

Cause

When a host uses the VIP IP without making the necessary configuration changes in Cisco ACI, the error message  "<hostname> lost N log messages" will appear on the host in vCenter. 

After changing the syslog target for the hosts via the Aria Operations for Logs UI, previously configured syslog servers are not removed and multiple syslog servers will be configured on the hosts. 

Resolution

You must unconfigure the syslog server using the VIP IP to remove it from the hosts configuration. Otherwise, multiple servers will be configured on the hosts. 

1. Log into Aria Operations for Logs using the admin account.
2. Go to Integration > vSphere and click the ellipses next to the vCenter server you want to reconfigure the syslog server for and click Edit. 
3. Change the Target drop down to the syslog server you want to remove from the hosts and click Save in the top right corner.
4. Click the Edit button in the top right. 
5. Click View Details next to Manage ESXi hosts configuration. 
6. Click the box next to the Host column to select all hosts, click Actions, then click Unconfigure. 
7. Change the Target drop down to the desired syslog server and click Save.
8. Click the Edit button in the top right.
9. Click View Details next to Manage ESXi hosts configuration.
10. Click the box next to the Host column to select all hosts, click Actions, then click Configure. 
11. Click Save in the top right corner.
12. Log into vCenter with an administrator account and select a host that was in the list of hosts you just reconfigured. 
13. Go to Configure > System > Advanced System Settings. 
14. Click the Filter icon in the Key column and enter Syslog.global.logHost
15. Verify that the host has the correct syslog servers configured.