After upgrade to Aria Operations for Logs 8.18.4 or 8.18.5, invalid or expired license message intermittently appear after user's login. Once you login to the via the load balancer the license key is correct but when you check from the individual nodes the primary show invalid or expired license and 1 or 2 other nodes shows invalid keys.
Steps from KB 376754 Aria Operations for Logs license is not valid error after upgrade have been tried but were not effective. The corrupted license key returns after some time.
Entries noted in the log file /storage/core/loginsight/var/runtime.log
["LogSearchMaster-thread-#"/##.##.##.## WARN] [com.vmware.loginsight.cassandra.CassandraClient] [Failed to decrypt:Given final block not properly padded. Such issues can arise if a bad key is used during decryption.]
OR
["application-akka.actor.default-dispatcher-#"/##.##.##.## WARN] [com.vmware.loginsight.cassandra.CassandraClient] [Failed to decrypt:Given final block not properly padded. Such issues can arise if a bad key is used during decryption.]
OR
["CheckPerformer-thread-#"/##.##.##.## ERROR] [com.vmware.loginsight.config.ADAuthenticationConfig] [Failed to decrypt AD password]
VMware Aria Operations for Logs 8.18.x
The license key is encrypted in the internal Cassandra database. During an upgrade, the license key is encrypted using a new encryption key. In some cases, the new encryption key fails to update on some nodes after the upgrade.
Log in to each VCF Operations for Logs node by using the node's FQDN/IP in the browser's address bar
Navigate to Management > License
Note all nodes where the license key does not appear in the format: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
Log in to the affected node as root via SSH
Restart the loginsight service
systemctl restart loginsight
Log in to the UI on the affected node and verify the issue is resolved.