Alert forwarded from Aria Operations for Logs does not appear in Aria Operations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

1. In Aria Operations for Logs, the alert is configured to forward to VMware Aria Operations with a fallback object selected.

2. A service account is being used for the Aria Operations integration in Aria Logs.

3. Aria Logs adapter connection is successful in Aria Operations, and data is being collected.

4. The test alert is sent to the email with no issue, but it shows Status Code - 403 as shown in the screenshot below:

5. Under /storage/core/loginsight/var/runtime.log in the primary node, "Response Code: 403" is also observed, and the ERROR log "Could not send VMware Aria Operations event notification". See the log snippet below:

Environment

Aria Operations 8.18.x

Aria Operations for Logs 8.18.x

Cause

The service account used for the Aria Operations integration in Aria Logs does not have the minimum permissions.

Resolution

Make sure you have followed the steps in Configure VMware Aria Operations for Logs to Send Notifications and Metrics to VMware Aria Operations, which leads you to Minimum Required Permissions for a Local or Active Directory User Account.