Unable to ingest logs from Linux server to Aria Operations for Logs

Products

• VCF Operations

Issue/Introduction

Linux server failed to ingest syslog data and system events to the Aria Operations for Logs cluster

Environment

• Aria Operations for Logs 8.18.x

Cause

The underlying issue is caused by the native Linux rsyslog service being in a dormant (inactive or stopped) state on the source machine.

Resolution

To resolve this issue and restore log ingestion, you must start and enable the native rsyslog service directly on the affected Linux server.

1. Log in to the affected Linux server via SSH as a root user.
2. Check the current status of the rsyslog service by running: systemctl status rsyslog
3. If the service is listed as inactive, dead, or dormant, start the service by running: systemctl start rsyslog
4. To ensure the service starts automatically upon future reboots, run: systemctl enable rsyslog
5. Verify that the service is now active and running: systemctl status rsyslog
6. Once the service is running, verify within the Aria Operations for Logs UI that logs from this specific Linux machine are now being actively received.

Additional Information

The Aria Operations for Logs agent relies on the operating system's native logging pipeline. If the rsyslog service is dormant, the Operating System will not actively process log events. Regardless of the liagent.ini file configuration, there will be no active log stream for the agent to pick up and ingest to the centralized logging cluster.