Unable to get logs from SRM in Aria Operations for Logs after installing the agent RPM package on the SRM appliances

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Unable to get logs from SRM in Aria Operations for Logs after installing the agent RPM package on the SRM appliances.
• No SRM related logs are sent to Aria Operations for Logs server
• When checking Management  > Agents, there are no entries for the SRM
• SRM appliances may be showing in Agents page but Events Sent is 0
• When checking /var/lib/loginsight-agent/cert/ folder on the endpoint, no certificate files are listed.

Environment

Aria Operations 8.18.x
Site Recovery Manager 9.0.2, Build 24170200
VMware - SRM 8.1+ Version 1.3 content pack

Cause

• The certificate on Aria Operations for Logs is a peer self-signed certificate causing a verification issue during agent communication so the certificate was not accepted
  
  
  • Running command: openssl s_client -connect <aria_ops_logs_fqdn>:9543 from one of the Aria Operations for Logs cluster nodes shows:
    
    verify error:num=19:self-signed certificate in certificate chain
    
    
    
  • Checking the latest liagent.log file in  /var/log/loginsight-agent/ on the target VM shows:
    
    

    YYYY-MM-DD HH:MM:SS.###### 0x0000############ <warn> SSLVerifyContex:### | Certificate pre-verify error = 19 while trying connect to '<aria_ops_logs_IP>'. self signed certificate in certificate chain
YYYY-MM-DD HH:MM:SS.###### 0x0000############ <error> CurlConnection:### | Transport error while trying to connect to '<aria_ops_logs_IP>': SSL peer certificate or SSH remote key was not OK

    
    
    
• The liagent.ini configuration is not setup properly such as hostname, directory or filelog parameters
  
  
  • Checking the latest liagent.log file in  /var/log/loginsight-agent/ on the target VM shows:
    
    

    YYYY-MM-DD HH:MM:SS.###### 0x0000############ <trace> EventCollector:##  | Configuring filelog
YYYY-MM-DD HH:MM:SS.###### 0x0000############ <warn> FLogCollectorEx:###| Cannot find section <filelog> in the configuration. The flat file log collector will stay dormant.

Resolution

• To resolve the certificate issue, try KBs:
  • Agent is not showing on the UI after successful installation
  • VM (Linux/Windows) not Visible in Aria Operations for Logs post installing the Agent
    
    
• Once the certificate or any other communication issue is resolved with the agent, there is configuration needed for the Agent Group which gets applied to liagent.ini and the liagent-effective.ini
  • Within Aria Operations for Logs, navigate to Content Packs > Installed Content Packs. Choose the content pack (for this example: VMware - SRM 8.1+ ) 
  • Click the gear icon and choose Setup Instructions to view the setup details

• • Under Agent Groups, there are instructions for setup and a note to ensure configuration is entered for your specific environment. This is done on the Administration > Agents page