One (or more) Windows machines are not forwarding logs to Aria Operations for Logs (formerly known as Logs Insight).

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In a working Aria Operations for Logs cluster, there may be one or more Windows machines which are not sending log data, even through the agent is installed and running.

Environment

Aria Operations 8.x

Cause

The liagent found in C:\ProgramData\VMware\Log Insight Agent still has its default configuration which has all the logging channels commented, that is, these channels are disabled by having a ";" at the beginning of the line.

Resolution

1. Launch the Windows services by running services.msc in the Windows start menu.

2. Stop the VMware Aria Operations for Logs Agent.

3. Open the configuration file C:\ProgramData\VMware\Log Insight Agent\liagent.ini and uncomment the Windows channels by deleting the semi-colon ";" at the start of the lines:

[winlog|Application]
channel=Applicaiton

[winlog|Security]
channel=Security

[winlog|System]
channel=System

[update]
; Do not change this parameter
package_type=msi

4. Save the liagent.ini file.

5. Start the VMware Aria Operations for Logs Agent.

Additional Information

See also KB 425006 which details the use of the Central config capability of Aria Operations for Logs.