Aria Operations for Logs not receiving logs from ESXi/Vcenter

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• VMware Aria Operations for Logs does not receive all expected log traffic from ESXi hosts.
• Log ingestion is intermittent for specific services or components.
• Certain log types, such as NSX Distributed Firewall packet logs (firewall-dfwpkt), are observed to be missing or dropped from the ingestion pipeline.

Environment

Aria Operations for Logs 8.18.X

Cause

This issue occurs because a log filtering rule configured within VMware Aria Operations for Logs is currently enabled to intentionally drop logs. 
This prevents the incoming logs from being ingested and processed by the system.

Resolution

• Log in to the VMware Aria Operations for Logs user interface.
• Navigate to Log Filtering (typically found under Log Management).
• Locate the active rule configured to drop the logs. 
• Disable or delete this rule to stop dropping the logs.
  

• Monitor the system to verify that new logs from the ESXi hosts or vcenter are now successfully being received and indexed.