Inconsistencies between log entries on ESX Host and Aria Operations for Logs.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In the file /var/log/vmkwarning.log on an ESXi host, you observe frequent entries similar to the following:

Heap: 4105: Heap_Align(VSI.20457580, 23104/23104 bytes, 8 align) failed. caller: 0x42002e838676

When attempting to search for these specific log entries within Aria Operations for Logs for the affected host, no results are returned. However, the entry is visible for other hosts, and other log entries for the affected host are correctly indexed in Aria Operations for Logs. Syslog settings across all hosts have been verified and confirmed to be identical.

Environment

Aria Operations for Logs 8.18.x

Cause

Firewall rule was only opened for an Operations for Logs node address and the syslog settings on host were pointing to the Operations for Logs Load Balancer address instead. 

Resolution

Please check firewall rules between ESXi host and Aria Operations for logs appliances.

Make sure there are rules for the IPs of all the Aria Operations for logs machines.