Log forwarding exclusion filters fail to drop appnames in Aria Operations for Logs.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Logs continue to appear in the SIEM destination even though the corresponding appnames are configured in the log forwarding exclusion filter.

• Log volume remains high for excluded appnames (e.g., osfsd, envoy-access, localcli).
• Logs may contain keywords related to system health and performance monitoring.
• Filter conditions appear correct but do not drop the targeted application logs.

Environment

Aria Operations for logs 8.18.x

Cause

The issue is caused by a configuration syntax error within the log forwarding exclusion filter. An unintended wildcard character (*) was added before the appnames in the exclusion list (e.g., *osfsd instead of osfsd). This extraneous character breaks the filter syntax and prevents it from matching the incoming application logs.

Resolution

Remove the unintended wildcard character from the affected appnames:

1. Navigate to Log management > Log forwarding.
2. Edit the specific log forwarding instance.
3. Review the exclusion filters and remove any extraneous wildcard characters (*) from the beginning of the appnames.
4. Save the configuration.
5. Monitor the SIEM destination for 15-30 minutes to verify logs are being successfully excluded.

Additional Information

• For more information on configuring log forwarding filters, see Add a Log Forwarding Destination.
• If you continue to see logs after correcting the syntax, verify if multiple forwarding destinations are active.