Black Box in Aria Operations for Logs when Querying Openshift Logs via Syslog

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When querying logs in the Explorer page from an Openshift environment to Aria Operations for Logs, a "black box" appears where data should be displayed, preventing the application group from viewing complete logs. Logs are being sent using the syslog protocol.

Environment

Aria Operations for Logs 8.18.x

Cause

• The problem was identified as a dynamic extracted field definition within the log processing.
• Specifically, the MessagePreviewGenerator's highlightField method encountered a StringIndexOutOfBoundsException during HTML encoding of certain log messages with nested highlighting. This led to the display of black boxes in the UI, indicating a failure in correctly rendering the log content.
• Issue was triggered by specific characteristics of the log data or extracted fields on the affected instance.

Resolution

• Identify and remove or disable the problematic dynamically extracted field (iErrorM) from the Aria Operations for Logs configuration.
• Disable all content packs by unchecking checkboxes under the Content Pack popup.