Known issues and limitations for Log Collection with VCF Operations Log Management

Products

• VCF Operations

Issue/Introduction

There are several known issues and limitations in the Log Collection framework. The issues discussed in this KB apply when Log Management is directly ingesting logs from the mentioned components or when a Unified Cloud Proxy Log Forwarder is used.

 

Limitations:

• Log Collection should be managed only by 1 VCF Operations per component. The behavior is undefined otherwise.
  
  
• This restriction applies to 9.1 VC and NSX.  When log collection is enabled, VCF Operations overwrites any existing log-collection configuration for these components
• The restriction does not apply to ESX. VCF Operations does not overwrite the ESX log destinations but rather adds to it. 
• The restriction does not apply to VC and NSX of versions below 9.1
  
  
• Operations for Networks log collection isn’t supported in VVF even if there’s a vRNI adapter instance configured. 

 

Environment

• 9.1
• 9.1.1

Resolution

Issue: Log Collection status reported in the Log Management Log Collection page is Failed for NSX, HCX, VC, and Supervisor components after certificate rotation

Affected version: VCF Operations 9.1.x

• Possible Causes: The certificate has been rotated, but the log collection framework still has not received the updated certificates.
• Resolution: The issue is only cosmetic; since these components are configured, the agent will continue to forward the logs. Within one hour, the configuration will sync between Log Management and the VCF Operations, and the status will be recovered.

 

Issue: Log Collection is failing due to a connectivity issue between the VCF component and the log collector.

Affected version: VCF Operations 9.1.x

• Possible Causes: Firewall issues, closed ports
• Resolution: Environment specific, has to be fixed by the customer

 

Issue: Log Collection status is Failed for NSX, HCX, VC, and Supervisor components

Affected version: VCF Operations 9.1.x

• Possible Causes: If the corresponding cloud account is created manually, the credentials might not have sufficient permissions to configure log collection
• Resolution: update the credentials on the cloud account

 

Issue: vCenter Log Collection configuration is lost when upgrading a VC to version 9.1

Affected version: VCF Operations 9.1.x

• Cause: Starting in vCenter 9.1, vCenter ships with the Log Insight Agent. If a VC has the agent already installed and is then upgraded to vCenter 9.1., the previously installed agent and any agent configuration is deleted. Further, if vCenter was configured to forward logs using syslog, the syslog targets are deleted. 
• Resolution: use the Log Management → configure collection page to enable and customize vCenter Log Collection. Enable log collection using the cloud account page for the corresponding vCenter adapter.

 

Issue: Field annotations defined for FQDNs/VIPs in the configuration → Log Management → Log Collection → Internal load balancer page are not applied to logs sent using syslog

Affected version: VCF Operations 9.1.x

• Possible causes: Known issue
• Resolution: There is no work around. Field  tagging only applies to logs sent using HTTP/HTTPS.

 

Issue: SDDC Manager Log Collection Status is "Failed"

Affected version: VCF Operations 9.1.1

• User visible symptom: The Log Collection status for the SDDC Manager is displayed as "Failed" in the Log Sources page. Description:
  
  The Log Collection failure happens under the following circumstances:
  More than one VCF Cloud accounts was already set up before Log Management was integrated into VCF Operations.
  Following the Log Management integration, log collection fails for specific SDDC Managers, returning the error: “Failed to propagate configuration to collector.”
  The VCF Operations bridge logs, displays the message: “Failed to create LI service account for.”
  
  
• Resolution: To workaround the issue, navigate to the VCF Cloud account page. Locate the affected VCF Adapter instance, and toggle the log collection by disabling it first, and enabling it again.

 

Issue: vCenter instances are showing as failed. "Failed to configure VC to send logs. The Collector attempts to configure log collection every 5 minutes. For more details, see KB Article 433089.

Affected version: VCF Operations 9.1.1 

• Cause: False Positive
  
  
  • Verify that the log collection is still occurring for the vCenter in VCF Operations:
    In VCF Operations navigate to Operate > Logs > Analyze Logs > In the Chart section you can set the following filters to determine if the vCenter Server logging is collecting and ensure this is a false positive. 
    Count of Events | Over Time | Grouped By: vmw_vcenter
    
    
• Resolution: Known issue, upgrade to VCF Operations 9.1.2.
  Note: See Internal Notes for PR information. 
  
  

 

 

Additional Information

For VC, NSX, and ESX, Log collection is enabled but doesn’t start unless the corresponding adapter is started.