How to monitor when getting unusually high number of logs from a particular host

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Esxi host issue where there is high amount of logs created per second could flood Aria for logs and cause performance issue .

Known issue which is related to this behaviour : ESXi host becomes disconnected, vm's not responding

Environment

Aria Operations for Logs 8.18.x

Resolution

This issue is resolved by following the KB described in the Issue/Introduction section.

The following are instructions on how to be alerted if this issue occurs in your environment:

Install Aria Operations for logs content pack and if you monitoring Aria for logs with different instance of aria for logs you can setup alert :

1. WARNING: Average ingestion rate is at greater than 80% capacity (ack and once rate decreases resolve)
2. *** CRITICAL *** Average ingestion rate is at greater than 100% capacity!!! (ack and once rate decreases resolve)