Aria operations for logs Nodes Fail to Forward Internal Logs via ILB VIP

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Cluster node with ILB role does not forward logs to external syslog server

• Internal logs generated by Aria Operations for Logs (vRLI) cluster nodes are intermittently missing from external syslog destinations.

Environment

Aria Operations for Logs 8.x

Cause

This issue is typically caused by "hair-pinning" or loopback limitations at the load balancer level. When a cluster node attempts to send its own logs to the ILB VIP (which may then route the traffic back to that same node), the connection can be dropped or timed out by the network stack or the ILB service.

Resolution

To ensure reliable ingestion, each Aria Operations for logs node should be configured to ingest its internal logs locally rather than through the VIP.

Steps:

Perform these steps on every node in the Aria Operations for logs cluster:

1. Log in to the node via SSH as root.

2. Backup the existing configuration file:

   cp /etc/liagent.ini /etc/liagent.ini.bak
   

3. Edit the configuration file:

   vi /etc/liagent.ini
   

4. Locate the [server] section and find the hostname parameter. Change it from the VIP address to the local node's IP address:

   • From: hostname=<VIP_IP>

   • To: hostname=<NODE_IP>

5. Save and exit the file (:wq).

6. Restart the Log Insight Agent service:

   /etc/init.d/liagentd restart