This past week we dropped the latest versions of the VMware Aria Suite: VMware Aria Operations 8.18.7 VMware Aria Operations for Logs 8.18.7 VMware Aria Suite Lifecycle 8.18.0 Patch 8 VMware Aria Automation Orchestrator 8.18.1 U6 (Patch 6) VMware Aria Automation 8.18.1 U5 (Patch 5) I'm running the following in my lab: VMware Aria Operations 8.18.6 VMware Aria Operations for Logs 8.18.6 VMware Aria Suite Lifecycle 8.18.0 Patch 7 VMware Aria Automation 8.18.1 U4 (Patch 4) Let's

I was trying to find VMs with duplicate IPs in my environment. There's no easy way to do this in VCF Operations as you can't compare VM Properties to other VM Properties in Alerts/Symptoms, so I started looking at VCF Operations for Logs and found this Alert Definition. As the Origin indicates, this Alert Definition comes with the VMware - vSphere Content Pack. Go to Content Packs - Installed Content Packs (in my case as it's already installed) - Alerts tab. Scrolling down

I was recently doing some Log Filtering in my VCF Operations for Logs 9.0.2 lab and noticed some nuanced behavior, namely when filtering logs based on text, this is what I found. In Log Management - Log Filtering you'll notice this. I'm trying to filter out any logs/events with the string "logout" in them, so I configured a filter against the text field and matches logout. What caught my eye right away is that there are only two operators here: matches and does not match. Y

For those if you running VCF Operations for Logs 8.18.x, ever wonder what this is? Yea me too. Documentation can be found here, but I wanted a bit more detail, here's what I found. By default, the Target should be the Operations for Logs Cluster VIP or the Primary Node in the Logs Cluster. I've not found a use case where one would configure this to be another VIP in your logs Cluster. This IP/FQDN is used in a couple different places. First, when sending an email notificat

In VCF Operations 9 we've made the integration between VCF Operations and Operations for Logs even more robust. There are several different places you can view logs in VCF Operations, Infrastructure Operations - Analyze is the first. This provides the general logs viewing experience: y ou can search logs here, compare logs, save queries, use extracted fields, and more. This is similar to the experience from the Operations for Logs UI itself. The second place you'll find log

VCF Operations for Logs 8.18.6 just dropped , let's apply it! Log into the Broadcom Support Portal and download this. In this lab I don't have Aria Suite Lifecycle Manager, so we'll apply it locally. First, take a Snapshot of your VM/s. Then log into Operations for Logs and go to Management - Cluster. Select UPGRADE CLUSTER. Click UPGRADE and off we go. Agree to the EULA when asked. And we're done, took about 5m! Back on the Management - Cluster page it will look like thi

Operations 8.18 introduced this idea of the Cloud Proxy for log forwarding, which we discussed previously here . In VCF 9 Operations we...

I wanted to forward VCF 9 Operations related logs to VCF 9 Operations for Logs, but looks like its moved. Administration - Control Panel...

We previously upgraded Aria Operations 8.18.3 to VCF Operations 9: first we did it directly then we did it via the Aria Suite Lifecycle...

We recently discussed pulling events from Operations for Logs via API, but I also discovered something in the UI people might like to know. That is, when you're exporting events from the UI there is a threshold at which you are forced to export events to an NFS share and that threshold is 20,000 events. Run a query (any query) that results in fewer than 20,000 events. Once complete, click the Export button top right. You can export the Event Results in three different form

I wanted to pull events out of Aria Operations for Logs via API, so I started exploring the available endpoints. The Operations for Logs REST API surface can be found at: https://your_logs_fqdn/rest-api/supported, mine looks like this. If you scroll down you'll notice there is an entire section dedicated to Querying. As indicates, to retrieve raw log messages we can use GET /api/v2/events. Scrolling down to the events endpoint, we have this. It's not at all clear what requi

We deployed Aria Operations earlier this week, let's now do Aria Operations for Logs! The latest version of Logs is 8.18.3 and can be downloaded here. Once downloaded, we'll deploy from vCenter. Of course you can deploy via Aria Suite Lifecycle Manager, I just don't have one available in this lab. My deployment went like this. Once deployed, I powered on the VM and accessed the Web Console, which game me this. Going to that URL gives me the startup screen. Click NEXT. Cli

I wanted to track vCenter logins across my estate, so started exploring Dashboards and Queries provided by the VMware- vSphere Content Pack. I blogged about something similar previously, but it wasn't exactly what I wanted, so I built my own, here's how. The VMware vSphere Content Pack has dozens of Dashboards, Queries, Alerts, and more. They can be seen here. One of the Dashboards that piqued my interest was Security - Authentication. It does provide vCenter logins, but al

I was trying to determine VMs built this month with Aria Operations and came up with this. Top left is a List View leveraging the "interval breakdown" and an "expression transformation. The bottom widget is another List View filtering on VMs built in the last 30 days. This isn't bad, but I'd like to get the VM creator, which isn't available as of 8.18.3. I do have a feature request open for this. If you'd like this Dashboard (and Views) you can get them here. I was also loo

If you're using Aria Operations for Logs and have installed the vSphere Content Pack, you'll notice dozens of Dashboards, Queries, Alerts, and more! I'm interested in users logging into my vCenters, specifically those logging in with adminstrator@vsphere.local. There's a Dashboard that gets close: VMware - vSphere: Security - Authentication. I'm interested in the vCenter Server authentication events bottom left, let's look at the Query. Click the icon top right that says "O

Part of the Aria Operations for Logs deployment is configuring an SMTP server, which is used to notify new users of their account creations. When a new user is created they receive an email similar to this. They will then click the link and reset their password. They will set their password and be sent into Operations for Logs. But what if there is no SMTP server? No problem, the local admin can set the user password and assign Roles once the userid has been created via API

For customers running several instances of the various Aria products, it can be helpful to tell users what instance they are actually logging in to. With Aria Operations and Operations for Logs this can be done with a login message. In Operations this can be found in Administration - Global Settings - User Access - Login Message. Now, when users log into Operations they will be presented with that message, it looks like this. If you have a Development instance, a Staging ins

Aria Operations for Logs 8.18.3 dropped earlier today, addressing several VMSAs/CVEs, all of which are documented here. The Logs 8.18.3 Release Notes can be found here. Let's apply it. Go to the Broadcom Support Portal and download it. I'm going to apply this locally via the UI. Go to Management - Cluster. Select UPGRADE CLUSTER and follows the prompts. Click UPGRADE. Accept the License Aggreement. Then just wait... My upgrade took 2-3 minutes. The About page will reflect

I wanted to pull logs from Aria Operations for Logs programatically via the API, so I went looking around for endpoints on the API surface. The first one that caught my attention was GET /events/{+path}. But whatever I tried for +path it didn't work, I continually got the missing_argument error. I didn't see any additional options on the public API, so I looked internally. The internal API can be found at https://your_logs_ip/rest-api/internal. The queries endpoint looks p

Yesterday we upgraded Aria Operations to 8.18.2, today we'll upgrade Operations for Logs to 8.18.1, which dropped along side the Operations release. Log into the Broadcom Support Portal and download the new Logs 8.18.1 binaries here. Once downloaded, log into your Logs UI and go to Management - Cluster. Click UPGRADE CLUSTER and follow the prompts. Once complete, you'll be prompted with this. Back in product you'll show Version 8.18.1 Aria Operations for Logs has now been up

The Aria Operations API is a powerful way of interacting programatically with Operations. There are several ways to authenticate with the API, let's explore them here. First, the Operations API can be accessed at the following URL: https://operations_ip_or_fqdn/suite-api The easiest way is local authentication via the Authorize button top right of the API home page, which you can do like this. The Authorize button issues a POST /suite-api/api/auth/token/acquire and caches t

The Aria Operations API gets most of the attention, but Aria Operations for Logs has a rich API surface as well, let's explore. First, your Logs API can be found at https://operations_for_logs_here/rest-api. It's a rich Swagger UI with several examples, which was introduced in 8.18 and documented by the Release Notes. First thing I noticed, is that when you attempt to authenticate via the Authorize button, you're prompted for a sessionId retrieved from /api/v2/sessions. For

Aria Operations for Logs 8.18 HF1 addresses two issues and 40 CVEs, it's documented here. Downloads are available at the same link, I'll download the PAK file and apply it to my existing Logs 8.18 Cluster. First, take Snapshots of the VMs that comprise your Logs Cluster. Once complete, log into your Logs Cluster and go to Management - Cluster. Click UPGRADE CLUSTER and select the previously downloaded PAK file. Click UPGRADE. Once complete, you'll be prompte with this. Then

Aria Operations 8.18 introduced the ability to use Cloud Proxys (CP) for log forwarding. Specifically, you can deploy a CP from Aria Operations to be used for log forwarding to Aria Operations for Logs, documentation can be found here, and here's how you do it. First, log into the Broadcom Support Portal and download the CP only package (OVA), I'm grabbing the 8.18.1 version. Once downloaded, deploy it from vCenter. At Step 9, it'll ask you for a Unique Registration Key, you