Even when specifying keywords in Aria Operations for Logs' Log Filtering, logs containing those keywords may sometimes fail to be filtered out as expected.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Depending on how rules are configured in Aria Operations for Logs, Log Filtering may not function as expected. This article explains the correct configuration method for specifying keywords within Log Filtering rules.

Symptoms:
Even when specifying a target string using a "text" operator in a Drop Filter within Aria Operations for Logs, log messages containing that specific string are not filtered out.

For example, if you configure a filter with the keyword vim.Datacenter.powerOnVm under Log Management > Log Filtering, log entries containing vim.Datacenter.powerOnVm continue to be ingested and remain visible when performing searches within the Explore Logs section after saving the configuration.

Environment

Aria Operations for Logs

Cause

This is because Log Filtering excludes a single-line syslog only when it completely matches the "matches" text rule configured in Aria Operations for Logs.
In the example shown in the image above, the log will be filtered only if the single-line log message exactly matches "vim.Datacenter.powerOnVm".
In other words, if there are any other strings before or after this keyword, the log will not be filtered.

Resolution

Utilize glob patterns (wildcard patterns) to allow matching regardless of any preceding or trailing characters around the keyword.
Example: *vim.Datacenter.powerOnVm*

This ensures that logs are filtered when they "contain" the string vim.Datacenter.powerOnVm.
If necessary, click "Run in Explore Logs page" after entering the keyword to verify which syslog will be matched.