Aria Operations for Logs Node(s) Showing Unknown Status

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• One or more Aria Operations for Logs nodes appear in Unknown status in the Cluster Management page
• Running the following command nodetool-no-pass status on an affected node shows that Cassandra is down
• The root partition is full (100% disk usage) on the affected nodes. After deleting unnecessary files (as per KB 318394) and restarting the Log Insight service, the node status changes to UP. However, the cluster continues to experience slow performance during operations and the node status may intermittently change to Unknown
• In System Monitor > Statistics, the Events ingestion rate (per second) exceeds the recommended limit of 15,000 EPS
  

Environment

VMware Aria Operations for logs 8.18.x

Cause

The maximum supported ingestion rate per node is 15,000 events/second. When a node receives events beyond this threshold, the Aria Operations for Logs cluster may behave abnormally, including services becoming unresponsive and nodes showing as unknown

Resolution

To resolve the issue, follow these steps:

• Reduce the Ingestion Rate

  • Apply filters on the log sources (e.g., vSphere, syslog forwarders, etc.) to only forward the most critical and necessary logs. This reduces the amount of data processed and stored, which helps minimize unnecessary overhead.

• Scale Out the Cluster

  • If the ingestion rate cannot be reduced, consider scaling out the cluster by adding additional nodes. Use the Aria Operations for Logs Sizing Calculator to calculate the required nodes for the cluster.

 

Additional Information

VMware Aria Operations for Logs Configuration Limits

Sizing the VMware Aria Operations for Logs Virtual Appliance