VMware Aria Operations for Logs 8.16 Release Notes

Release	Date	Build Number
VMware Aria Operations for Logs 8.16	29 FEBRUARY 2024	23364779

Check for additions and updates to these release notes.

About VMware Aria Operations for Logs

VMware Aria Operations for Logs delivers the best real-time and archived log management, especially for VMware environments. Machine learning-based intelligent grouping and high performance search enables faster troubleshooting across physical, virtual, and cloud environments. VMware Aria Operations for Logs can analyze terabytes of logs, discover structure in unstructured data, and deliver enterprise-wide visibility using a modern web interface.

For more information, see the VMware Aria Operations for Logs product documentation.

What's New

Here are some of the key highlights of the VMware Aria Operations for Logs 8.16 release:

License Enhancements

VMware Aria Operations for Logs supports single license to provide simplified and uniform license management across components in the VMware Cloud Foundation bundle. For more information, see About VMware Aria Operations for Logs Licenses.

Support for Configuration APIs Related to User Management and Log Forwarding

New APIs are introduced to access and create user groups and manage user roles and capabilities.
A new API is added for log forwarding that shows the count of forwarded and dropped logs.

User Experience Enhancements

The user experience of the Log Export and Shared Dashboard URLs configuration pages are enhanced to provide a more streamlined and intuitive experience.

Performance Improvements

The detection of smart fields in VMware Aria Operations for Logs has been optimized to decrease the number and time range of Schema Discovery queries freeing computation resources for other operations.

Stability Improvements

Stability improvements are applied to the support bundle generation process to ensure a seamless experience.

Security Fixes

This release resolves multiple security fixes. For more information on these vulnerabilities and their impact on VMware products, see KB - 96438.

Compatibility

VMware Aria Operations for Logs 8.16 can be integrated with the following VMware products and versions:

VMware vCenter Server 7.0 or later (FIPS mode supported).
VMware Aria Operations 8.6 or later.

You can install and upgrade VMware Aria Operations for Logs using VMware Aria Suite Lifecycle. For more information, see the VMware Aria Suite Lifecycle Installation, Upgrade, and Management Guide.

Browser Support

VMware Aria Operations for Logs 8.16 supports the following browser versions. More recent browser versions also work with VMware Aria Operations for Logs, but have not been validated.

Mozilla Firefox 80.0 and above
Google Chrome 91.0 and above
Safari 13.1.2 and above
Microsoft Edge 91.0 and above

The minimum supported browser resolution is 1280 by 800 pixels.

Important: Cookies must be enabled in your browser.

VMware Aria Operations for Logs Agent Support

VMware Aria Operations for Logs Windows Agent Support

The VMware Aria Operations for Logs 8.16 Windows agent supports the following versions:

Windows 10, Windows 11 (supported, but not tested)
Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019.

VMware Aria Operations for Logs Linux Agent Support

The VMware Aria Operations for Logs 8.14 Linux agent supports the following distributions and versions:

RHEL 7, RHEL 8, and RHEL 9
SLES 12 SP5 (supported, but not tested), and SLES 15 SP3 (supported, but not tested)
Ubuntu 18.04, Ubuntu 20.04, and Ubuntu 22.04
Debian 10, and Debian 11
VMware Photon version 3, and Photon version 4 (supported, but not tested)

Upgrading from a Previous Version of VMware Aria Operations for Logs

Keep in mind the following considerations when upgrading to VMware Aria Operations for Logs 8.16.

Upgrade Path

You can upgrade to VMware Aria Operations for Logs 8.16 from version 8.14.

Starting from VMware Aria Operations for Logs version 8.16, the upgrade process enables secure authenticated mode for inter-node communication. However, this mode is enabled only if the rolling upgrade is successful. It is not updated in case of a manual upgrade.

Important Upgrade Notes

To upgrade to VMware Aria Operations for Logs 8.16, you must be running VMware Aria Operations for Logs 8.14.
When performing a manual upgrade from the command line, you must upgrade workers one at a time. Upgrading more than one worker at the same time causes an upgrade failure.
Upgrading must be done from the primary node's FQDN. Upgrading with the Integrated Load Balancer IP address is not supported.
The VM's SSH fingerprint is not preserved and changes after every upgrade, which might impact the appearance and user interface for users who connect using SSH. You must accept a new SSH fingerprint after the upgrade.

Internationalization Support

VMware Aria Operations for Logs 8.16 includes the following localization features:

The VMware Aria Operations for Logs web user interface is localized to Japanese, French, Spanish, German, Simplified Chinese, Traditional Chinese, and Korean.
The VMware Aria Operations for Logs web user interface supports Unicode data, including machine learning features.
VMware Aria Operations for Logs agents work on non-English native Windows.

Limitations

VMware Aria Operations for Logs 8.16 has the following limitations:

General

VMware Aria Operations for Logs does not handle non-printable ASCII characters correctly.
The hosts table might display devices more than once with each in a different format, including some combination of IP address, hostname, and FQDN. For example, a device named foo.bar.com might appear as both foo and foo.bar.com.

The hosts table uses the hostname field that is defined in the syslog RFC. If an event sent by a device over the syslog protocol does not have a hostname, VMware Aria Operations for Logs uses the source as the hostname. This might result in the device being listed more than once because VMware Aria Operations for Logs cannot determine if the two formats point to the same device.
Once activated, FIPS mode cannot be disabled.

VMware Aria Operations for Logs Windows and Linux Agents

Non-ASCII characters in hostname and source fields are not delivered correctly when VMware Aria Operations for Logs Windows and Linux agents are running in syslog mode.

VMware Aria Operations for Logs Windows Agent

The VMware Aria Operations for Logs Windows agent is a 32-bit application and all its requests for opening files from C:\Windows\System32 sub-directories are redirected by WOW64 to C:\Windows\SysWOW64. However, you can configure the VMware Aria Operations for Logs Windows agent to collect from C:\Windows\System32 by using the special alias C:\Windows\Sysnative. For example, to collect logs from their default location for the MS DHCP Server, add the following line to the corresponding section of the VMware Aria Operations for Logs Windows agent configuration file: =C:\Windows\Sysnative\dhcp.

VMware Aria Operations for Logs Linux Agent

Due to an operating system limitation, the VMware Aria Operations for Logs Linux agent does not detect network outages when configured to send events over syslog.
The VMware Aria Operations for Logs Linux agent does not support non-English (UTF-8) symbols in field or tag names.
The VMware Aria Operations for Logs Linux agent collects hidden files and directories by default. To prevent this, you must add an exclude=.* option to every configuration section. The option exclude uses the glob pattern .* which represents hidden file format.
When standard output redirection to a file is used to produce logs, the VMware Aria Operations for Logs agent might not correctly recognize event boundaries in such log files.

VMware Aria Operations for Logs Integrations

Launch in context, both from VMware Aria Operations for Logs and VMware Aria Operations, does not work for a virtual machine when the IP address of the virtual machine is not visible to the VMware Aria Operations instance and is not shown by the vCenter on the virtual machine's VM Summary tab. The IP address might be unavailable because of the absence of the vmware-tools utility. Older, unsupported versions or malfunctioning vmware-tools can also cause the IP address to become unavailable.

Ensure that a proper version of VMware Tools is installed on the virtual machine and that the VM Summary tab of the vCenter displays the IP address of the virtual machine.

Resolved Issues

Account locked when you attempt to login using your AD credentials.

In an Active Directory enabled environment, your account gets locked, when you exceed the specified number of incorrect password attempts.

Fatal error occured when the cluster is on FIPS mode.

When you have enabled FIPS mode on a cluster, the cluster nodes restart frequently due to a fatal error.

The Importer command fails with an error.

The Importer command fails with an unrecognized provider error and can not push logs to VMware Aria Operations for Logs.

The host name resets to "localhost" after VM reboot.

If you have changed the hostname by using the set_hostname.py command, and restart the VM, the hostname resets to "localhost".

The Cassandra query language shell (cqlsh) command fails with the connection error.

When you attempt to join a new node to a cluster with a custom certificate or when you attempt to apply the licf certificate to a cluster, you see the connection error.

VMware Aria Operations for Logs UI is inaccessible after upgrade.

VMware Aria Operations for Logs User Interface is inaccessible or unstable or the clusters crash after upgrade.

Failed to create index directory searcher.

After the database upgrade from version 3 to version 4 (VMware Aria Operations for logs Version 8.12), few configurations were required to address the timeout issue or unexpected restart issue.

Known Issues

The following known issues are present in this release.

Failure to save a configuration when there is a long list of filters in agent groups

VMware Aria Operations for Logs fails to process a long list of filters in agent groups and does not save any configuration because of this issue.

Workaround: Modify the internal configuration manually to remove or reduce the number of filters in the agent group or divide the filters into multiple agent groups.

VMware Aria Operations for Logs does not send more than 10 logs in webhook notifications.

Regardless of the Log Payload option, VMware Aria Operations for Logs sends only up to 10 individual notifications or 10 logs in the payload to the webhook endpoint.

Workaround: None.

Users are not notified about the cloud channel integration failure

You do not receive any notifications regarding failures related to cloud channel integration and cloud forwarding.

Workaround: Check the VMware Aria Operations for Logs runtime.log file for related issues, or check if the corresponding cloud organization is receiving the logs.

Inactive host notifications are sent when logs are relayed to VMware Aria Operations for Logs (SaaS)

In VMware Aria Operations for Logs, when you select the Inactive hosts notification check box on the Management > Hosts page, and select the Relay Only option while configuring log forwarding to VMware Aria Operations for Logs (SaaS), you receive inactive host notifications.

The value in the Last Received Event column in the Hosts page increases with time, which indicates that a previously active host does not ingest logs anymore.

This behavior is because log events are not considered received until the events are ingested. When you select the Relay Only option for cloud forwarding, a certain category of log events are never ingested (depending on your filter definition), which results in some hosts mistakenly reporting as non-ingesting and inactive.

Workaround: None.

The first run for real-time alerts is delayed

The first run for a real-time alert is scheduled five minutes after creating or enabling the alert.

Workaround: Wait for five minutes after creating or enabling a real-time alert for the scheduler to work as expected. After the first five minutes, the alert query is run every minute.

Collection from some of directories will not take place if they were created before agent start or re-configuration event

The logs are not collected from the newly created directories if you create the directories after re-configuring the agent.

Workaround: To start directory monitoring, restart the service or update the agent configuration. You can update the agent configuration using the liagent.ini file or from the Server Admin Agents page.

No automatic upgrade for VMware Aria Operations for Logs Agent on Photon OS

You cannot automatically upgrade VMware Aria Operations for Logs Agent on Photon OS because Photon OS does
not support the gpg command.

Workaround: Perform a manual upgrade.

SMTP configurations might not work for public mail servers through IPv6

SMTP configurations might not work with public email services such as Google and Yahoo, because these services leverage tighter restriction policies for IPv6.

Workaround: Use an alternative mail server such as your corporate mail server, or create a dedicated server.

Integrating VMware Workspace ONE Access with VMware Aria Operations for Logs through IPv4 changes the redirect URL host to IPv6 address

When deploying a VMware Aria Operations for Logs virtual appliance, If you had selected the option to prefer IPv6 addresses, the redirect URL host list is always populated with IPv6 node addresses. This redirect URL does not work when integrating VMware Aria Operations for Logs with VMware Workspace ONE Access as VMware Workspace ONE Access does not support IPv6 addresses.

Workaround: Create a different IPv4 virtual IP for the integration of VMware Aria Operations for Logs with VMware Workspace ONE Access.

Test connection fails for VMware Aria Operations for Logs Agent running on the Windows OS.

Test connection fails for VMware Aria Operations for Logs Agent running on the Windows OS, however the agent is able to successfully communicate and send logs to the VMware Aria Operations for Logs server.
Workaround: None