Aria Operations for Logs (Formerly vRealize Log Insight) is not able to collect logs from some of the vCenter servers

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• VMware Aria Operations for Logs is integrated with many vCenter servers, out of which it cannot collect logs from a few vCenter servers.
• The password is correct and the connection is successful, but still collection failed status is visible.
• The following admin alert may be observed: 'vCenter Kubernetes Service event collection failed'.
• A similar error will be visible in the /storage/core/loginsight/var/plugins/vsphere/li-vsphere.log:

  ["ScheduledPluginServiceScheduledTask-thread-1"/##.##.##.## ERROR] [com.vmware.loginsight.scheduled.ScheduledPluginService] [Timeout while waiting for WCP events from <vCenter_FQDN>, timeout=600000 millis. vCenter can't complete requested range in time. Increasing vsphere's config event-collection-timeout-millis may mitigate the problem but that may introduce delays to other vCenter collectors.]

Environment

Aria Operaitons for Logs 8.x

Cause

The default timeout value is set to 600,000 milliseconds. When a large number of events are processed simultaneously, vCenter may not complete the request within this timeframe, resulting in missed log entries.

Resolution

This issue can be fixed by increasing the timeout value by following the below steps.

Note: Take a snapshot of each Aria Operations for Logs appliance in the cluster or backup of the config file before making the changes.

Steps:

1. Open https://<Aria_Operations_for_logs_fqdn>/internal/config in a new browser window.
2. Login using admin credentials.
3. Add the below line under the <vsphere> tag in this format:

   <event-collection-timeout-millis value="1200000" />

   Sample:
   
   

4. Save the settings.
5. Reload the Aria Operations for Logs UI and log in again.
6. The collection will start happening after a while.

 

If this method does not work you will need to update the 'loginsight-config.xml#xxx'  file on the Aria Operations for Logs appliance.

1. Open an SSH session to each Aria Operations for Logs node.
2. Navigate to the config directory

   cd /storage/core/loginsight/config

3. Make a backup of the most recent config.xml file;

   cp loginsight-config.xml#xxx loginsight-config.xml#xxx.old

4. Edit the config.xml to include the event-collection property under the <vsphere> tag

   vi loginsight-config.xml#xxx
   <event-collection-timeout-millis value="1200000" />

5. Restart the Aria Operations for Logs service

   service loginsight restart

6. After the restart, the collections should begin after some time.

Additional Information

Impact/Risks:
Logs will not be collected for some of the vCenter Servers and the collection status will show an Error.