Logs are not forwarding from VCF Operations to VCF Operations for Logs.

Products

• VCF Operations

Issue/Introduction

No Logs forwarded to VCF Operations for Logs from VCF Operations using the syslog protocol.

• The log forwarding option is enabled within the VCF Operations UI.

• No logs are being received or displayed in VCF Operations for Logs.

• Reviewing the log agent configuration (liagent.ini) on the VCF Operations node shows that it is pointing to the Primary node FQDN of VCF Operations for Logs instead of the Load Balancer.

Environment

VCF Operations 9.x
VCF Operations for Logs 9.x

Cause

This issue is caused by "hair-pinning" or loopback limitations at the network. When the agent attempts to send logs to the Primary node FQDN of VCF Operations for Logs (which may resolve to its own IP or a local interface), the network stack may drop the packets or fail to route them correctly back to the intended collection point.

Resolution

To resolve this issue, manually update the log agent configuration to point to the VCF Operations for Logs Integrated Load Balancer (ILB).

1. Log in to the VCF Operations node as root via SSH.

2. Navigate to the /etc/ directory and open the liagent.ini file (often referenced as liagentd) using a text editor:

   vi /etc/liagent.ini
   

3. Locate the [server] section and update the hostname or target field to the FQDN or IP address of the VCF Operations for Logs ILB.

4. Save the changes and exit the editor.

5. Restart the log agent service to apply the changes:

   service liagentd restart
   

6. Verify in the VCF Operations for Logs UI that logs are now flowing from the VCF Operations node.