Traffic not received by ILB node in Aria Operations for Logs when VIP offloading is enabled

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In an Aria Operations for Logs (formerly vRealize Log Insight) cluster environment integrated with Cisco ACI, you may observe the following symptoms:

• Cisco ACI balancing issue causing one node to ingest over 15k/sec, significantly higher than other nodes.
  
  
• The node currently hosting the Integrated Load Balancer (ILB) VIP is not accepting or receiving any traffic.

• Other nodes in the cluster receive traffic normally, but the ILB node remains idle or shows no incoming data in the System Monitor.

• Traffic balancing issues may have been previously observed within the Cisco ACI fabric.

Cause

This issue is caused by the <layer4-vip-offload-enabled> parameter being set to true in the internal configuration. When VIP offloading is enabled, it can prevent the local node hosting the VIP from correctly processing incoming Layer 4 traffic in certain network configurations, such as Cisco ACI.

Resolution

To resolve this issue, you must disable the Layer 4 VIP offloading setting:

1. Log in to the Aria Operations for Logs UI as an Administrator.

2. Navigate to the internal configuration page by appending /internal/config to the URL (e.g., https://<log-insight-ip>/internal/config).

3. Locate the <load-balancer> section.

4. Find the following entry: <layer4-vip-offload-enabled value="true" />

5. Change the value to false: <layer4-vip-offload-enabled value="false" />

6. Save the configuration.

7. Verify on the System Monitor page that the ILB node is now receiving traffic.