Login failure due to root partition full as the 'liagent.db' has become oversized on an Operations for Logs instance.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Users are unable to log into the VMware Aria Operations for Logs UI using either the local admin account or Active Directory accounts.
• Service unresponsiveness and UI login failures occur because the root partition (/) becomes 100% full on the impacted nodes. 
• The root partition is sized at 3.6 GB.
• The largest file in the root partition is the 'liagent.db' in '/var/lib/loginsight-agent/storage' 

Environment

• VMware Aria Operations for Logs 8.18.3.

Cause

The root partition exhaustion is caused by the 'liagent.db' file growing to approximately 900MB.

Due to the nodes being provisioned with an unusually small root partition of 3.6GB, the database file consumes the remaining available space after attempting to send logs to a potentially stale endpoint

Resolution

1. Stop the Log Insight agent service by running the command:

   service liagentd stop

2. Remove the oversized agent database file by running the command:

   rm /var/lib/loginsight-agent/storage/liagent.db

3. Disable the agent service to prevent future disk consumption if the forwarding endpoint is no longer in use by running the command:

   systemctl disable liagentd

Additional Information

Deleting the 'liagent.db' file and disabling the 'liagentd' service is a safe remediation strategy when the agent is not actively required for forwarding logs.

Executing these steps successfully frees space on the root partition, restoring full cluster stability and UI access for day-to-day operations. A long-term resolution may require increasing the root partition size to match the standard 7.6GB footprint if the agent service is needed in the future.