Aria Automation Auditd Logs Fail to Forward and Configuration is Overwritten

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When attempting to push auditd logs from VMware Aria Automation (vAA) appliances to Aria Operations for Logs (vAOL) or a central log aggregator, no logs are received.

Manually appending a custom [filelog|audit_logs] block to the Log Insight agent configuration file at /etc/liagent.ini does not persist, as the changes are repeatedly overwritten and reverted by the system.

Environment

VMware Aria Automation 8.18.x

Cause

The Log Insight agent (liagent) configuration and its default data directory are strictly managed by the Aria Automation vracli service.

Any manual modifications to the agent configuration managed by this service are systematically reverted during service updates or agent restarts.

Resolution

The Log Insight agent utilizes a data directory (datadir) to store configurations and certificates. The default path for version 8.18.x is /var/lib/loginsight-agent/.

Because vRA strictly manages this default directory, the agent must be redirected to a custom directory to prevent manual configurations from being overwritten.

• Identify and store the current datadir path. Run the following command:
  
  datadir=$(dirname $(readlink -e /etc/liagent.ini)) && echo $datadir
  
  (Note: The output should resemble /var/lib/loginsight-agent).
  
  
• Copy the existing configuration to a new, unmanaged directory:
  
  cp -r $datadir $datadir-custom
  
  
• Verify the current execution start command in the systemd unit file:
  
  grep ExecStart /usr/lib/systemd/system/liagentd.service
  
  (Expected output: ExecStart=/bin/bash -c '/usr/lib/loginsight-agent/bin/liagent --daemon ').
  
  
• Modify the liagentd.service unit file to point the agent to the new custom data directory by passing the new path as a command line argument:
  
  sed -i 's!.*ExecStart.*! ExecStart=/bin/bash -c '"'/usr/lib/loginsight-agent/bin/liagent --daemon --datadir $datadir-custom'"'!' /usr/lib/systemd/system/liagentd.service
  
  
• Verify the modification was successful by re-running the grep command:
  
  grep ExecStart /usr/lib/systemd/system/liagentd.service
  
  (Expected output: ExecStart=/bin/bash -c '/usr/lib/loginsight-agent/bin/liagent --daemon --datadir=/var/lib/loginsight-agent-custom').
  
  
• Reload the systemd configuration to apply the service changes:
  
  systemctl daemon-reload
  
  
• Restart the Log Insight agent service:
  
  systemctl restart liagentd.service
  
  
• Edit the agent configuration file located in the new custom directory (e.g., /var/lib/loginsight-agent-custom) to add any required log configurations. Because this path is unmanaged, changes will not be overwritten by vRA.

Additional Information

How do I configure log forwarding to VMware Aria Operations for Logs in VMware Aria Automation