TAS Logs Truncated in VMware Aria Operations for Logs

Products

• VMware Tanzu Application Service

Issue/Introduction

Tanzu Application Service (TAS)  logs appear complete and correct when viewed directly on the VMs. Logs forwarded to VMware Aria Operations for Logs (formerly Log Insight) appear broken, cut, or truncated. The issue persists even when using TCP for syslog transmission.

Environment

TAS + Log Insight (VMware Aria Operations) 

Cause

This issue is caused by a discrepancy between the maximum message size supported by the TAS syslog-agent and the maximum limit enforced by the receiving syslog server.

• TAS syslog-agent: Based on the RFC 5424 syslog standard, which allows sending log envelopes of up to 64KB via TCP.
• Aria Operations for Logs: Enforces a maximum configuration limit of 10KB for individual syslog messages.

When the TAS sends a log envelope exceeding 10KB, the Aria Operations for Logs server truncates the message to fit within its supported limit.

Resolution

To resolve or mitigate this behavior, ensure that log messages do not exceed the receiving server's maximum supported size.

1. Monitor Log Size: Identify if specific application or system logs are consistently exceeding the 10KB threshold.
2. External Documentation: Refer to the official VMware Aria Operations for Logs Configuration Limits https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations-for-logs/8-18/aria-operations-for-logs-8-18/configuring-vrealize-log-insight/vrealize-log-insight-configuration-limits.html  for more information on message size constraints.
3. Alternative Collection: If logs larger than 10KB are required without truncation, consider using the Aria Operations for Logs Agent (if applicable) or other ingestion methods that may support larger payloads than standard syslog. https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations-for-logs/8-18/administering-vmware-aria-operations-for-logs-agents-8-18/overview-of-vrealize-log-insight-agents.html 

Additional Information

 Understanding Application Log Limit Changes Starting in TAS v3.0 https://knowledge.broadcom.com/external/article/298139/understanding-application-log-limit-chan.html