High CPU utilization by Aria Operations for Logs Agent on Windows servers due to redundant parser configurations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

The Aria Operations for Logs Agent service consumes abnormally high compute resources (consistently >30% and often spiking to 40-50% CPU) on Windows servers. Observed this behavior even when there are no processes running inside the VM.

Environment

• Aria Operations for Logs 8.18.x

Cause

• The high CPU utilization is caused by an excessive number of log parsers configured within the agent's liagent.ini file for log paths or logging that do not actually exist on the affected servers.
• The liagent.ini file defines extensive rules for unavailable logging, causing the agent service to continuously poll for non-existent logs. This constant, redundant parsing consumes significant compute resources and spikes CPU usage.

Resolution

To resolve the high CPU consumption, optimize the agent configuration across all affected servers by removing unnecessary parsers or reverting to the default configuration.

1. Log in to the affected Windows server as an Administrator.
2. Open the windows Services (services.msc) and stop the Aria Operations for Logs Agent service.
3. Navigate to the agent's configuration directory, located at: %ProgramData%\VMware\Log Insight Agent\
4. Open the liagent.ini file in a text editor.
5. Review the configured sections, paying close attention to the [filelog|...] and [parser|...] definitions.
6. Remove any parser configurations and file paths for logs that are not actively generated on the specific server. Alternatively, if no custom parsing is needed, revert the file to its default configuration.
7. Save the changes to the liagent.ini file.
8. Return to the list of Windows Services (services.msc) and start the Logs Agent service service.

Monitor the server's Task Manager; the CPU utilization for the agent process should drop to normal/expected levels.

Additional Information

Default Configuration of the VMware Aria Operations for Logs Windows Agent