Email notification regarding SSL Handshake errors is sent daily

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

1. System Alert "SSL Certification Error" triggers daily and sends out email notifications "VMware Aria Operations for Logs Admin Alert: SSL Certificate Error (Host = example.com)" from each node daily around the same time. See example below:

2. This alert is triggered on the security systems that you do not have access to, and not in the vCenters that are integrated in Aria Logs.

3. These systems are listed under Hosts in Aria Logs UI.

Environment

Aria Operations for Logs 8.18.x

Cause

Endpoints are attempting to send encrypted syslog to Aria Operations for Logs, but are terminating the connection because they do not trust the certificate from Aria Operations for Logs.

Resolution

Configure the endpoints to stop sending syslog to Aria Logs, so the alerts will no longer trigger.

Or

Configure the endpoints to trust the Aria Logs certificate.

Or

Configure the endpoints to use an unencrypted transmission protocol.

 

Note: The issue must be resolved on the endpoints sending the syslog traffic, as there is no configuration setting in Aria Operations for Logs that can force the endpoints to trust the certificate.