vCenter Server 'messages' log is not collected by Aria Operations for Logs vSphere Integration and how to forward custom logs

Products

• VCF Operations
• VMware vCenter Server 8.0

Issue/Introduction

• [Collect events] (Collect events, tasks, and alarms) is enabled in the vSphere integration settings of VMware Aria Operations for Logs.
• Local OS logs generated on the vCenter Server Appliance (vCSA), such as /var/log/vmware/messages, are not ingested into Aria Operations for Logs.

Environment

Aria Operations for Logs 8.18.x
vCenter Server 8.x

Cause

The [Collect events] feature in the Aria Operations for Logs vSphere integration is designed to pull structured data (events, tasks, and alarms) via the vSphere API. It does not directly read or collect local OS files (such as messages or syslog) residing on the vCSA.

Resolution

Instead of modifying the vCenter OS settings (such as rsyslog configurations), update the monitoring script to send Syslog messages directly to Aria Operations for Logs over the network using the logger command.

Aria Operations for Logs includes a built-in standard Syslog server functionality and officially supports receiving messages from external hosts on port 514.

As a workaround, you can use logger command.
Below command put your message to Aria Operations for Logs from vCenter.

/usr/bin/logger -n <IP_Address_of_Aria_Operations_for_Logs> -P 514 -p user.info "Your custom message here"