Aria Suite Lifecycle Manager Appliance /dev/sda4 Partition Remains Constantly Full

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

The Aria Suite Lifecycle precheck for patch fails on the appliance if the / partition has less than 3 GB of available storage.

Running the df -h command on appliance shows /dev/sd4 is 100 % full

Running the find command shows below log files are being generated with big size even after removing it or rebooting the Aria Suite lifecycle appliance.

find / -xdev -type f -size +100M -exec du -sh {} ';' | sort -rh | head -n50

Example:  access.log,vmware_vrlcm.log and other.

When viewing the output of cat /var/log/nginx/access.log, it indicates that debug logging is enabled in the rsyslog.conf file.

18: 37. 862589+00: 00 ############### debug 2025-08-15T07:18:37. 862399+00:00 ############### debug 2025-08-15T07: 18:37. 862208+00:00 ############### debug 2025-08-15T07:18:37.862020+00:00 ############### debug 2025-08-15T07:18:37.861838+00:00 ############### debug 2025-08-15T07:18:37. 861649+00:00 ############### debug 2025-08-15T07:18:37.861459+00:00 ############### debug 2025-08-15T07:18:37.861274+00:00 ############### debug 2025-08-15T07:18:37.861084+00:00 ############## debug 2025-08-15T07:18:37.860901+00:00 ############### debug 2025-08-15T07:18:37.860714+00:00 ############### debug 2025-08-15T07:18:37. 860540+00:00 ############### debug 2025-08-15T07:18:37.860371+00:00 ############### debug 2025-08-15T07:18:37.860205+00:00 ############### debug 2025-08-15T07:18:37.860035+00:00 ############### debug 2025-08-15T07:18:37.859850+00:00 ############### debug 2025-08-15T07:18:37. 859675+00:00 ############### debug 2025-08-15T07:18:37.859 481+00:00 ############### debug 2025-08-15T07:18:37.858982+00:00 ############### debug 2025-08-15T07:18:37.858818+00:00 ############### 2025-08-15T07:36:27.526673+00:00 ############### kernel: [ 1759.272479] audit: type=1701 audit (###############. 519: 45) : auid=############### uid=0 gid=0 ses=############### subj=unconfined pid=4059 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" sig=6 res=1

 

Environment

Aria Suite Lifecycle Manager 8.18.x

Cause

• The issue is caused by manual changes to the rsyslog file that enabled debug logging, resulting in excessive log generation and disk space consumption on the appliance.

Resolution

To resolve the issue follow the steps:

1.Take a snapshot of the Aria Suite Lifecycle appliance

2.To identify large files in the root directory:

find / -xdev -type f -size +100M -exec du -sh {} ';' | sort -rh | head -n50

Size variable +100M can be altered to flag files over a specific size, for example to flag files greater than 50MB it would be +50M refer "The /dev/sda4 partition has insufficient free disk space" message during prechecks for upgrade of Aria Suite Lifecycle to 8.14 or higher"

3.Remove all unnecessary binary files by navigating to the Aria Suite Lifecycle UI > Lifecycle Operations > Setting > Binary Mapping > Select Binary file > Click on delete button.

4.Stop the below services

systemctl stop nginx.service

systemctl stop vrlcm-server.service 

systemctl stop blackstone-spring.service

5.Validate the rsyslog.conf file using the command vi /etc/rsyslog.conf. If any entry other than auth.log is found, update it as per the instructions provided below.

save the file with escape wq!

6.Or restore the file from a backup, if one is available on the appliance.

cp rsyslog.conf.bak rsyslog.conf

7.Reboot the appliance 

reboot -f