Alert generated twice by Aria Operations for Logs Content Pack

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Alert is triggered based on log event and then triggered again when the logs are rotated.
  • Example of log event that triggered the alert (before the log rotation)

[2026-01-09 02:20:22.042+0000] ["main"/0.0.0.0 INFO] [com.vmware.loginsight.daemon.LogInsightDaemon] [VMware Aria Operations for Logs WORKER node: <uuid> has been restarted by watchdog after the crash.]
source: 0.0.0.0 appname: loginsight build_number: 24515748 cluster_guid: <uuid> cluster_name: <fqdn> event_type: v4_6129aba1 filepath: /storage/core/loginsight/var/runtime.log hostname: <fqdn> node_guid: <uuid>  server_admins: <email> session_guid: <uuid> version: 8.18.3 vmw_cluster: <cluster_name> vmw_datacenter: <datacenter_name> vmw_host: <hosts_name> vmw_object_id: <vm_id> vmw_vcenter: <vcenter_fqdn> vmw_vcenter_id: <uuid> vmw_vr_ops_id: <uuid>  java_thread: main node_address: 0.0.0.0 severity: INFO java_class: com.vmware.loginsight.daemon.LogInsightDaemon

 

• • Example of log event that triggered the alert (after the log rotation)

[2026-01-12 21:55:22.042+0000] ["main"/0.0.0.0 INFO] [com.vmware.loginsight.daemon.LogInsightDaemon] [VMware Aria Operations for Logs WORKER node: <uuid> has been restarted by watchdog after the crash.]
source: 0.0.0.0 appname: loginsight build_number: 24515748 cluster_guid: <uuid> cluster_name: <fqdn> event_type: v4_6129aba1 filepath: /storage/core/loginsight/var/runtime.log.1 hostname: <fqdn> node_guid: <uuid>  server_admins: <email> session_guid: <uuid> version: 8.18.3 vmw_cluster: <cluster_name> vmw_datacenter: <datacenter_name> vmw_host: <hosts_name> vmw_object_id: <vm_id> vmw_vcenter: <vcenter_fqdn> vmw_vcenter_id: <uuid> vmw_vr_ops_id: <uuid>  java_thread: main node_address: 0.0.0.0 severity: INFO java_class: com.vmware.loginsight.daemon.LogInsightDaemon

Environment

Aria Operations for Logs 8.x

Cause

The configuration for the Agent Group in VMware Aria Operations for Logs Content Pack doesn't exclude the historical files:

[filelog|standard]
directory=/storage/core/loginsight/var
include=runtime*;ui*;vcenter_operations*;vrops_integration*;nsx_integration*
event_marker=^\[
parser=standard-parser

Resolution

WORKAROUND

• Dynamic configuration (liagent-effective.ini): /var/lib/loginsight-agent/liagent-effective.ini
• Static configuration (liagent.ini): /var/lib/loginsight-agent/liagent.ini

1. Copy the dynamic configuration (liagent-effective.ini) to static (liagent.ini)
   cp /var/lib/loginsight-agent/liagent-effective.ini /var/lib/loginsight-agent/liagent.ini 


2. Replace "*" symbol with ".log" in the "include=" section of liagent.ini  
   Before: include=runtime*;ui*;vcenter_operations*;vrops_integration*;nsx_integration* 
   After: include=runtime.log;ui.log;vcenter_operations.log;vrops_integration.log;nsx_integration.log


3. Stop dynamic configuration by disabling central config in the "Server" section of liagent.ini
   Change the central_config from yes to no.
   
   
   
   
4. No need for a service restart as any change in liagent.ini file is automatically detected and applied.

 

Note:

• Once the central config is set to no, Agent Group configuration on the server will not be propagated.
• If central config is not disabled, it may end up with 2 similar file log configurations with undefined behavior.

In case of multiple agents or if the central config must be enabled, the configuration of applicable Agent Group can be changed by replacing "*" with ".log" in "Include Files" field under File Logs section (Management > Agents > Agent Configuration > Build tab > File Logs > Standard > Include Files)

 

Additional Information

Fix will be provided in the future Aria Operations for Logs release.