Unable to View Audit Events Due to Password Expiration in VMware Aria Operations

Products

• VCF Operations

Issue/Introduction

• This article addresses issues where Audit events are no longer visible in the interface or integrations fail to connect due to password expiration.
  
  
• Symptoms:
  
  
  • Audit events are missing under Operations > Audit events.
    
    
  • Authentication failure messages in the Aria Operations UI or when connecting via REST API.
    
    
  • Log files show authentication failures, unauthorized errors (401), or password policy violations.
    
    
  • Integrations (e.g., Aria Operations for Logs) fail to connect to Aria Operations.

Environment

VCF Operations 8.18.x

Cause

VMware Aria Operations currently does not provide a user interface to check when a password will expire or configure it to never expire. When an integration account password expires, the user is forced to change it on the next successful login attempt, causing automated integrations to fail.

Resolution

1. Checking Account Lockout Status: To check if a user account is locked:
   
   
   1. Log in to the Aria Operations UI as an administrator.
   2. Navigate to Control Panel > Access Control > User Accounts.
   3. Check the Locked column for the status of the specific user.
      
      
2. Analyzing Log Files for Authentication Failures: If authentication fails and you suspect an expired password, inspect the log files on the Aria Operations nodes.
   
   
   • For Aria Operations Authentication Failures:
     
     
     1. Log Path: /storage/log/vcops/log/analytics-.log
     2. Look for exceptions like: 

        WARN [ServerConnection...] ... com.vmware.vcops.auth.server.UserAuthenticationServer.handleAuthenticationFail - Authentication Failed. Error: Password expired: userId [ID], username [username]

         

     3. Audit Logs: /storage/log/vcops/log/analytics.audit-.log will also show: 

        Category : AUTHENTICATION_LOGIN - Log in failed. Origin: "REST_API". Due to the following error: "Password is expired".

   • For Aria Operations for Logs Integration Failures:
     1. Check on Aria Operations nodes:

        /storage/log/vcops/log/adapters/LogInsightAdapter/LogInsightAdapter_*.log

         
        • Look for 401 Unauthorized errors stating "errorMessage":"Invalid credentials or account is locked."
          
          
     2. Check on Aria Operations for Logs nodes: 

        /storage/core/loginsight/var/vrops_integration.log

        • Look for ClientSideException: Password Policy Violated. followed by Reason: "Password expired: [X] day(s) ago."

Additional Information

• If you receive an AuthException with the message "The provided username/password or token is not valid," verify the credentials being used by the integration service.
  
  
• For persistent service accounts, ensure regular rotation or management to avoid unexpected expirations that disrupt integrations.
  
  
• Reference: Change password expiration policy for local user in VMware Aria Operations