Complementary tags not appearing at Syslog endpoint

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Complementary tags (e.g., vc_username, vc_vm_name, vc_event_desc) display successfully within the Aria Operations for Logs user interface. However, forwarded events received at the Syslog endpoint (e.g., Microsoft Sentinel, rsyslog) completely lack these tag fields even though the "Forward complementary tags" feature is explicitly enabled. Consequently, only the raw, unenhanced Syslog message reaches the external destination.

Environment

Aria Operations for Logs 8.18.x

Resolution

Confirm the appliance correctly forwards tags using a packet capture.

1. Ensure Log Forwarding settings include the Forward complementary tags option.
2. Log in to the ESXi host managing the Aria Operations for Logs node.
3. Perform a packet capture on the ESXi host switchport for the specific VM. Reference Create Packet Capture File to Diagnose syslog Connectivity
4. Analyze the outbound network traffic using a packet analyzer tool to inspect the TCP payload of the Syslog packets, confirming whether the appliance actually includes the vc_username or vc_event_desc tags before they leave the host.
5. If tags are found in the outbound packet capture, the issue resides with the Syslog endpoint (e.g., Microsoft Sentinel) or intermediate network parsing, rather than the Aria appliance itself.

Additional Information

Log forwarding not sending tags in Aria Operations for Logs