Log Forwarding instance is showing "Idle" state in Aria Operations for logs

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Log forwarding instance in Aria Operations for Logs shows an "Idle" state.
  
• The following certificate-related errors are identified in the /storage/core/loginsight/var/runtime.log:
  

  ["IngestionForwarder-thread-8"/##.##.##.## INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Found not trusted SSL certificate for <log forwarding instance FQDN>:10514]
  ["IngestionForwarder-thread-8"/##.##.##.## ERROR] [com.vmware.loginsight.ingestion.forwarding.SyslogForwarder] [Error untrusted certificate]
  com.vmware.loginsight.commons.exceptions.CustomCertificateException: null
          at com.vmware.loginsight.commons.security.ExtendedTrustManager.checkServerTrusted(ExtendedTrustManager.java:68) ~[commons-lib.jar:?]
          at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source) ~[?:?]
          at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source) ~[?:?]
          at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source) ~[?:?]
          at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source) ~[?:?]
          at sun.security.ssl.SSLHandshake.consume(Unknown Source) ~[?:?]

Environment

VMware Aria Operations for Logs 8.18.x

Cause

The log forwarding target destination presented a new or untrusted SSL certificate, causing the forwarding connection to fail and enter an Idle state.

Resolution

Follow the steps below to accept the new SSL certificate and restore log forwarding:

1. Log in to the Aria Operations for Logs UI as an administrator.
2. Navigate to Log Management > Log Forwarding.
3. Select and edit the affected log forwarding destination.
4. Click Test Connection.
5. When prompted, accept the new/untrusted SSL certificate from the target destination.
6. Click Save to apply the configuration.