Aria Operations for Logs cluster crashing due to Kubernetes collection issue

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• The Aria Operations for Logs cluster intermittently crashes and the UI becomes unavailable until all nodes are rebooted
• You are using Kubernetes in your environment
• In /storage/core/loginsight/var/runtime.log, you see out of memory errors:

[2025-12-10 20:51:51.980+0000] ["DaemonCommands-thread-11"/IP_Address ERROR] [com.vmware.loginsight.daemon.StrataServiceFailureHandler] [Fatal error:]

java.lang.OutOfMemoryError: unable to create native thread: possibly out of memory or process/resource limits reached

at java.lang.Thread.start0(Native Method) ~[?:?]

at java.lang.Thread.start(Unknown Source) ~[?:?]

• Also in /storage/core/loginsight/var/runtime.log, you see many entries similar to the following, enumerating Kubernetes namespace collection tasks:

[2025-12-10 20:10:48.660+0000] ["pool-10-thread-7"/IP_Address INFO] [com.vmware.loginsight.scheduled.VSphereWCPConnector] [Ingested total WCP 0 events for host hostname]
[2025-12-10 20:10:48.671+0000] ["pool-191-thread-1"/IP_Address INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Response Code : 200]
[2025-12-10 20:10:48.671+0000] ["pool-191-thread-1"/IP_Address INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Processed GET request to https://vcenterFQDN/rest/vcenter/namespaces/events/ in 67msec]
[2025-12-10 20:10:48.761+0000] ["pool-191-thread-3"/IP_Address INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Response Code : 200]
[2025-12-10 20:10:48.761+0000] ["pool-191-thread-3"/IP_Address INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Processed GET request to https://vcenterFQDN/rest/vcenter/namespaces/events/ in 152msec]

 

 

Environment

Aria Operations for Logs 8.18.x

Cause

This behavior is caused by a collection issue of Kubernetes namespaces.

Resolution

This issue will be resolved in a future release of Aria Operations for Logs.

To workaround the issue, disable WCP (Kubernetes) collection for the time being:

1. Navigate to https://AriaOperationsForLogsHostnameOrIP/internal/config
2. Log in with local admin credentials
3. Click the "Show all settings" checkbox
4. Under the <vsphere> section, you will see a setting labeled wcp-collection-enabled
5. Change the value to false, so that the line resembles the below:

<wcp-collection-enabled value="false" />


Click Save to commit the change.

Next, perform a rolling reboot of the Aria Operations for Logs nodes to ensure the changes take effect:

1. Gracefully shut down the worker nodes first via the Actions > Power menu in the vSphere Web Client
2. Gracefully shut down the primary node via the Actions > Power menu in the vSphere Web Client
3. Power on the primary node
4. Power on the worker nodes

After a few minutes, when the UI becomes available, check the https://AriaOperationsForLogsHostnameOrIP/internal/config page to confirm that the prior changes to disable WCP held through the reboot.