Aria Operations for Logs Agents Failing to Report Data to Management Console after upgrading to 8.18.6

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Agents are no longer reporting data or appearing as "Offline" within the management interface after upgrading to 8.18.6. Specific symptoms include:

• Agent status showing as disconnected or inactive.

• Gaps in historical data reporting for specific nodes.

• No recent updates in the "Last Reported" timestamp despite the agent service running on the host.

• In the liagent<date>.log, you see the errors:

SSLHandshakeException: Insufficient buffer remaining for AEAD cipher fragment BadPaddingException

Environment

Aria Operations for Logs 8.18.x

Cause

 

1. The system fails to correctly update to the new certificate during the 8.18.6 upgrade process, leading to a buffer mismatch during the SSL handshake.

2. Network latency or firewall blocks on the reporting port.

3. Corrupted local agent cache or configuration files.

4. SSL/TLS certificate mismatch or expiration between the agent and the server.

Resolution

1. Verify Network Connectivity

Ensure the agent host can reach the management server over the required ports. Run a connectivity test from the agent machine:

• Windows PowerShell: Test-NetConnection <Server_IP> -Port <Port_Number>

• Linux: nc -zv <Server_IP> <Port_Number>

2. Check Agent Logs

Review the local agent logs for "Connection Refused" or "Handshake Failed" errors.

• Windows Path: %ProgramData%\VMware\Log Insight Agent\logs\ 

• Linux Path:  /var/log/loginsight-agent/

3. Restart Agent Services

In many instances, a service restart clears hung threads or re-establishes a stale connection.

• For Windows, restart the VMware Aria Operations for Logs Agent service via the Services console.

• For Linux systems, run systemctl restart liagentd.

4. Validate SSL Certificates

Ensure that the management server's certificate is trusted by the agent's local keystore. If the certificate was recently renewed, the agent may need to be updated with the new thumbprint.

5. Re-establish trust

Re-establish trust between the agent and server:

• For Windows, edit the C:\ProgramData\VMware\Log Insight Agent\liagent.ini and add or set the parameter, ssl_accept_any=yes to the file, Save and Close.
  
  
• For Linux, edit /var/lib/loginsight-agent/liagent.ini.
  
  
• Edit liagent.ini so the SSL section looks like this:

; SSL usage. Default:
ssl=yes
ssl_accept_any=yes
; Example of configuration with trusted CA:
;ssl=yes
;ssl_ca_path=/etc/pki/tls/certs/ca.pem

• Restart the agent service:

  • For Windows, restart the VMware Aria Operations for Logs Agent service via the Services console.

  • For Linux systems, run systemctl restart liagentd.

6. Replace SSL Certificate

• Replace your certificate and restart the loginsight service (service loginsight restart) following Install a self-signed certificate. 

Additional Information

Please see the Broadcom techdocs article for Troubleshooting Agents.

Details regarding the logical overview of agents can be found in this techdocs article.