Log forwarding not restricting based on filter and forwarding unconfigured logs to Splunk

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Log forwarding in Aria Operations for Logs is configured to restrict to specific logs (appnames), but it appears to be also forwarding logs not configured.
• Logs continue to be forwarded to the Splunk destination endpoint despite configured exclusion filters (e.g., text does not match: verbose, debug)..
• High log volume persists in Splunk for logs expected to be excluded
• runtime.log displays Pending queue is full warnings and significant event drop rates.

Environment

• Aria Operations for Logs 8.18.x
• Splunk

Cause

Exclusion filters are evaluated as literal exact matches because they lack the required wildcard operators (*). In the loginsight-config.xml file, the filter expressions appear as text=~"verbose" instead of the required wildcard-enabled format. Furthermore, if another Aria Operations for Logs instance is simultaneously forwarding logs to the same Splunk destination, the cumulative volume can saturate the queue.

Resolution

1. Navigate to Log management > Log forwarding.
2. Edit the specific log forwarding instance impacting the Splunk destination.
3. Update the exclusion filters to use wildcard syntax to ensure proper substring matching:
   • Set text to does not match *verbose*
   • Set text to does not match *trivia*
4. Save the configuration. This ensures the filter string compiles in the backend as text=~"*verbose*" and text=~"*trivia*" to properly exclude these substrings.
5. Verify that no other Aria Operations for Logs instance is inadvertently forwarding logs to the same Splunk destination.
6. Monitor the Splunk destination for 15–30 minutes to confirm traffic stabilization.

Additional Information

• Log forwarding exclusion filters fail to drop appnames in Aria Operations for Logs
• Aria Operations for Logs log forwarding functionality issues
• Log forwarding failures when using Text and Matches filters

Subscriptions: To receive updates on this or related issues, you can subscribe to notifications by following the steps in this guide: Subscribe to a Broadcom knowledge article by article or product.