Log events display gibberish characters in VCF 9.0.2 Operations for Logs and VCF 9.1 Log Management

Products

• VCF Operations

Issue/Introduction

When viewing log events in VCF Operations for Logs, several log entries contain cryptic, garbled, corrupted, or gibberish characters in the Explore Logs page.

Environment

• VCF Operations for Logs 9.0.x
• VCF Operations 9.1

 

Cause

The issue is caused due to incorrect protocol and port in the liagent configuration on the source. 

Resolution

To resolve the issue, follow the below steps:

1. Identify the source of these logs by checking it on the specific log event
   
   
   
   
2. SSH into the source and login as root.
3. Open the liagent file in an editor 
   
   

   vi /var/lib/loginsight-agent/liagent-effective.ini 

   
   
   
4. Check the protocol and port value under [server] in the file
   
   
   
   
5. Confirm that protocol used aligns with the port specified. For example, for cfapi, 9000 port should be in use. Similarly for Syslog, 514. 
6. After making the changes, save the file by running:
   
   

   :wq!

   
   
   
7. Restart the liagent service on the source
   
   

   systemctl restart liagentd

   
   
   
8. The logs should render the logs correctly