VCF Operations for Logs - cacerts corruption due to memory exhaustion

Products

• VCF Operations

Issue/Introduction

• In the VCF Operations UI: Infrastructure Operations >> Configurations >> Log Collection
  A warning is displayed: For the data to load, configure vCenter appliance,And the previously configured integrations are missing.
• In the VCF Operations for Logs UI: Integrations >> vSphere
  An error is displayed: Something went wrong, please reload the page. And the vSphere integrations which had previously been present here are missing.
• Operations for Logs lost connection to the Identity Broker (vIDB), meaning it is not possible to login to the Operations for Logs UI using an SSO user.
• The Infrastructure Operations >> Analyze section of the Operations UI is blank.
• On the VCF Operations for Logs appliance, an entry similar to the following indicates memory exhaustion in the file: /storage/core/loginsight/var/runtime.log
[2026-03-28 18:57:24.377+0000] ["Timer-7"/<NODE IP> INFO] [com.vmware.loginsight.daemon.LogInsightDaemon] [Memory usage is 8376936264 bytes (99%)]
• On the VCF Operations for Logs appliance, an entry similar to the following indicates that the memory exhaustion occurred due to the alias learning process, in the file /storage/core/loginsight/var/runtime.log
[2026-03-28 18:57:24.377+0000] ["PeerLogImporterService Server"/<NODE IP> ERROR] [com.vmware.loginsight.daemon.StrataServiceFailureHandler] [Fatal error:]  java.lang.OutOfMemoryError: Java heap space at com.vmware.loginsight.analytics.PackedTimestamps.allocIntArray(PackedTimestamps.java:99)  at com.vmware.loginsight.analytics.TimestampFieldCache$CacheEntry.allocIntArray(TimestampFieldCache.java:146) at com.vmware.loginsight.analytics.PackedTimestamps.allocateDeltasIfNeeded(PackedTimestamps.java:88)  at com.vmware.loginsight.analytics.PackedTimestamps.allocate(PackedTimestamps.java:188)  at com.vmware.loginsight.analytics.TimestampFieldCache$CacheEntry.allocate(TimestampFieldCache.java:140)  at com.vmware.loginsight.analytics.TimestampFieldCache.loadTimestampsFromReader(TimestampFieldCache.java:464) at com.vmware.loginsight.analytics.TimestampFieldCache.get(TimestampFieldCache.java:306)  ...  at com.vmware.loginsight.analytics.LogSearcher.search(LogSearcher.java:166) at com.vmware.loginsight.analytics.MultiLogSearcher.doSearchOnIndexBucket(MultiLogSearcher.java:810)

Environment

VCF Operations for Logs 9.0.2

Cause

Memory exhaustion occurs due to the alias learning process, leading to corruption of the cacerts truststore. This component automatically executes complex, heavy regular expression queries in the background to learn and link log fields. These queries attempt to cache massive arrays of timestamps in memory, which quickly overwhelms the Java heap space and crashes the node.

Resolution

1. Log in to the VCF Operations for Logs web interface as an Admin.
2. Navigate to the internal configuration page by appending /internal/config to your cluster's URL (e.g., https://<Operations-for-Logs-FQDN>/internal/config).
3. Scroll down and check the "Show all settings" box if it is present.
4. Locate the enable-alias-learning value configuration in the XML editor and set the value to false, as per snippet below:
   

   <config>
      ...
      <alias>
         <enable-alias-learning value="false"/>
      </alias>
      ...
   </config>

5. Click Save at the bottom of the page.
6. Replace the cacerts file using the procedure described in KB How to replace a corrupted truststore in Aria Operations for Logs