vCenter Collection Status = Unknown and not seeing vCenter logs

Products

• VMware Aria Suite

Issue/Introduction

Integrations / vSphere Page shows VC Collection Status = Unknown

Or 

VC Collection Status = Timeout or Collection error

Environment

VMware Aria Operations for Logs 8.18

Cause

This is a known issue supported by a log message in logs similar to the below:

["ScheduledPluginServiceScheduledTask-thread-2"/10.xx.xx.xx ERROR] [com.vmware.loginsight.scheduled.ScheduledPluginService] [Could not get the connected cluster nodes to reassign vSphere integrations to them]

This error can present itself in different logs:

/storage/core/loginsight/var/runtime.log
/storage/core/loginsight/var/plugins/vsphere/li-vsphere.log

Resolution

Workaround 1: Edit the reference to the standalone (primary) node in the /internal/config page to use the IP address of the node instead of the existing FQDN. 

Changing internal configuration options in VMware Aria Operations for Logs describes how to perform edits on the /internal/config page.

ORIGINAL:

 <distributed overwrite-children="true">
    <daemon host="ariaoperationsforlogs.example.com" port="16520" token="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx">
      <service-group name="standalone" />
    </daemon>
    <daemon host="10.xx.xx.xx" port="16520" token="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx">
      <service-group name="workernode" />
    </daemon>
    <daemon host="10.xx.xx.xx" port="16520" token="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx">
      <service-group name="workernode" />
    </daemon>
  </distributed>

EDITED:

<distributed overwrite-children="true">
    <daemon host="10.xx.xx.xx" port="16520" token="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx">
      <service-group name="standalone" />
    </daemon>
    <daemon host="10.xx.xx.xx" port="16520" token="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx">
      <service-group name="workernode" />
    </daemon>
    <daemon host="10.xx.xx.xx" port="16520" token="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx">
      <service-group name="workernode" />
    </daemon>
</distributed>

For vCenter integrations, if there are no credential or certificate thumbprint issues and the test connection is successful, you can proceed to restart the Log Insight service using the commands below. After the service restarts, the vCenter collection status should update to "Collecting."

Note: If you have an Aria Operations for Logs cluster setup, ensure that you restart the Log Insight service on all nodes, starting with the Primary node, followed by the Worker nodes.

service loginsight stop
service loginsight start

Workaround 2

• Edit the reference to the standalone (primary) node in the /internal/config page by replacing the FQDN with the IP address as mentioned above.
• Log in Aria Operations for Logs UI with admin credentials remove the affected vCenters from the integration.
• Navigate to Aria Operations for Logs UI > Integration > vSphere > Select vCenter > Delete > Remove Configuration > OK.
• Stop the Log Insight services on all nodes.(Starting from Primary node)

service loginsight stop

• Restart the Log Insight services on all nodes.(Starting from Primary node)

service loginsight start

• Re-add the vCenters using their IP addresses instead of FQDN
• https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations-for-logs/8-18/aria-operations-for-logs-8-18/integrating-vrealize-log-insight-with-vmware-products/connect-log-insight-to-a-vcenter-server.html
• Verify the collection status in the Aria Operations for Logs UI  > Integration > vSphere > Confirm that VC collection status shows collecting.