Configure VMware Aria Operations for Logs agents

VMware Aria Suite Lifecycle supports VMware Aria Operations for Logs for log analysis.

The content pack in VMware Aria Operations for Logs for VMware Aria Suite Lifecycle agent is pre-installed on the VMware Aria Suite Lifecycle virtual appliance. You can configure the VMware Aria Suite Lifecycle appliance to forward cfapi or system logs, and events to the VMware Aria Operations for Logs instance. To use the VMware Aria Suite Lifecycle content pack dashboards and widgets, the configuration should be done on cfapi only.

Prerequisites

Verify that you already have the VMware Aria Operations for Logs server details before you set the properties of the Log Insight agent.

Procedure

Log in to the VMware Aria Suite Lifecycle virtual appliance.
1. Open a Web browser and go to https://vRSLCMIP/vrlcm and log in with your user credentials.
2. Click Lifecycle Operations from the Home page, and then click Settings > Logs > Logs Insight Agent Configuration.
3. Update the following parameters in the VMware Aria Suite Lifecycle UI section and save your changes.
```
[server]
hostname= vRealize Log Insight hostname proto=cfapi port=9000 SSL=no
```
  When VMware Aria Operations for Logs server is not configured to accept an SSL connection, enabling SSL for VMware Aria Operations for Logs agents in VMware Aria Suite Lifecycle is optional.
  
  Or
```
hostname=vRealize Log Insight hostname proto=cfapi port=9543  SSL=yes
```
  When the VMware Aria Operations for Logs is configured to accept an SSL connection, VMware Aria Operations for Logs agents must be configured to use the SSL connection in VMware Aria Suite Lifecycle.
  
  Or
```
hostname=vRealize Log Insight hostname proto=syslog port=514 
SSL Server Certificates 
```
  Set the rules for how the VMware Aria Operations for Logs client handles the validation of the VMware Aria Operations for Logs server certificate. Certificates received by the VMware Aria Operations for Logs agent are stored locally on the agent host machine.
```
Accept Any
Accept Any Trusted
Common Name: (Self-signed server certificate is accepted if its Common Name matches this value)
Certificates acceptance rules:
```
  Note: VMware Aria Operations for Logs agents that receive a new self-signed certificate with the same public key as the existing locally stored self-signed certificate will accept the new certificate. For instance, a self-signed certificate may be regenerated with an existing private key but with a new expiration date.
  If the Agent has a locally stored self-signed certificate and receives a valid CA-signed certificate, the Agent silently accepts the CA-signed certificate.
  
  Agents that have a CA-signed certificate will reject self-signed certificates. The agent accepts self-signed certificates only when it initially connects to the Log Insight server.
  
  If an agent with a locally stored CA-signed certificate receives a valid certificate signed by another trusted CA, it is rejected by default. You can select Accept Any Trusted to accept the certificate.
  
  Reconnection Time: 30 min (Time in minutes to force reconnection to the server. This option mitigates the imbalances caused by long-lived TCP connections).
  
  Max Buffer Size: 200 (Max local storage usage limit(data+logs) in MBs. Valid range: 100-2000 MB. Default: 200 MB).
Perform the following steps to properly configure the required liagent.ini file so that logs can be sent to VMware Aria Operations for Logs.
1. SSH to VMware Aria Suite Lifecycle and navigate to the /var/lib/loginsight-agent/ folder.
2. Edit the liagent.ini file and uncomment [filelog|syslog]. Use the following excerpt as reference:
```
# Uncomment the appropriate section to collect system logs
        # The recommended way is to enable the Linux content pack from LI server
        [filelog|syslog]
        directory=/var/log/*
```
3. Restart the liagent. Use the following command line as reference:
```
/etc/init.d/liagentd restart
```
Configure the Linux Agent Group on the VMware Aria Operations for Logs Administration UI .
1. Open a Web browser and go to https://vRealize Log Insight hostname/IP.
2. Log in with the credentials - User name as admin and Password as vrli_admin_password.
3. Click the configuration drop-down menu icon and select Administration.
  
  Note: The content pack is not pre-installed in VMware Aria Operations for Logs. You must install the pack by downloading it from the Marketplace and then configure the agents.
4. Under Management, click Agents.
5. From the drop-down menu on the top, select VMware Aria Suite Lifecycle from the Available Templates section.
6. Click Copy Template.
7. After copying the template provide VMware Aria Suite Lifecycle Ipv4 or FQDN, and save the configuration.
8. Once the configuration is complete, the VMware Aria Suite Lifecycle events or logs start to flow into VMware Aria Operations for Logs and the relevant widgets displays the data.