ESXi host logs missing in destination for Aria Operations for Logs log forwarding

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VCF Operations

Issue/Introduction

In VCF Operations for Logs (formerly Aria Operations for Logs), logs from specific ESXi hosts are not visible in the configured destination (e.g., PAX collector, SIEM) despite the Log Forwarding rule status appearing healthy. This occurs even when the same logs are visible within the Explore Logs tab.

• Log forwarding rule for ESXi logs is active and healthy.
• Logs from certain hosts (e.g., ####vmwhost####) are missing in the destination.
• "Run in Explore Logs" for the forwarding rule confirms specific hosts are excluded from results.

Environment

• VCF Operations for Logs 9.0.x
• Aria Operations for Logs 8.18.x

Cause

The filter logic for the Log Forwarding rule is too restrictive. For example, a filter configured for hostname matches *vmhost* will not include hosts with naming conventions like 'vmwhost' or other variations not captured by the specific wildcard string.

Resolution

1. Log in to the Operations for Logs UI.
2. Navigate to Log Forwarding.
3. Locate and edit the impacted forwarding rule.
4. Identify the hostname matches filter line.
5. Add an OR condition to include the missing naming convention (e.g., add *vmwhost* if the original was only *vmhost*).
6. Click Run in Explore Logs to verify that the missing hosts now appear in the results.
7. Save the Log Forwarding configuration.