This past week we dropped the latest versions of the VMware Aria Suite: VMware Aria Operations 8.18.7 VMware Aria Operations for Logs 8.18.7 VMware Aria Suite Lifecycle 8.18.0 Patch 8 VMware Aria Automation Orchestrator 8.18.1 U6 (Patch 6) VMware Aria Automation 8.18.1 U5 (Patch 5) I'm running the following in my lab: VMware Aria Operations 8.18.6 VMware Aria Operations for Logs 8.18.6 VMware Aria Suite Lifecycle 8.18.0 Patch 7 VMware Aria Automation 8.18.1 U4 (Patch 4) Let's

We recently discussed pulling events from Operations for Logs via API, but I also discovered something in the UI people might like to know. That is, when you're exporting events from the UI there is a threshold at which you are forced to export events to an NFS share and that threshold is 20,000 events. Run a query (any query) that results in fewer than 20,000 events. Once complete, click the Export button top right. You can export the Event Results in three different form

I wanted to pull events out of Aria Operations for Logs via API, so I started exploring the available endpoints. The Operations for Logs REST API surface can be found at: https://your_logs_fqdn/rest-api/supported, mine looks like this. If you scroll down you'll notice there is an entire section dedicated to Querying. As indicates, to retrieve raw log messages we can use GET /api/v2/events. Scrolling down to the events endpoint, we have this. It's not at all clear what requi

We deployed Aria Operations earlier this week, let's now do Aria Operations for Logs! The latest version of Logs is 8.18.3 and can be downloaded here. Once downloaded, we'll deploy from vCenter. Of course you can deploy via Aria Suite Lifecycle Manager, I just don't have one available in this lab. My deployment went like this. Once deployed, I powered on the VM and accessed the Web Console, which game me this. Going to that URL gives me the startup screen. Click NEXT. Cli

I wanted to track vCenter logins across my estate, so started exploring Dashboards and Queries provided by the VMware- vSphere Content Pack. I blogged about something similar previously, but it wasn't exactly what I wanted, so I built my own, here's how. The VMware vSphere Content Pack has dozens of Dashboards, Queries, Alerts, and more. They can be seen here. One of the Dashboards that piqued my interest was Security - Authentication. It does provide vCenter logins, but al

I was trying to determine VMs built this month with Aria Operations and came up with this. Top left is a List View leveraging the "interval breakdown" and an "expression transformation. The bottom widget is another List View filtering on VMs built in the last 30 days. This isn't bad, but I'd like to get the VM creator, which isn't available as of 8.18.3. I do have a feature request open for this. If you'd like this Dashboard (and Views) you can get them here. I was also loo

If you're using Aria Operations for Logs and have installed the vSphere Content Pack, you'll notice dozens of Dashboards, Queries, Alerts, and more! I'm interested in users logging into my vCenters, specifically those logging in with adminstrator@vsphere.local. There's a Dashboard that gets close: VMware - vSphere: Security - Authentication. I'm interested in the vCenter Server authentication events bottom left, let's look at the Query. Click the icon top right that says "O

Part of the Aria Operations for Logs deployment is configuring an SMTP server, which is used to notify new users of their account creations. When a new user is created they receive an email similar to this. They will then click the link and reset their password. They will set their password and be sent into Operations for Logs. But what if there is no SMTP server? No problem, the local admin can set the user password and assign Roles once the userid has been created via API

For customers running several instances of the various Aria products, it can be helpful to tell users what instance they are actually logging in to. With Aria Operations and Operations for Logs this can be done with a login message. In Operations this can be found in Administration - Global Settings - User Access - Login Message. Now, when users log into Operations they will be presented with that message, it looks like this. If you have a Development instance, a Staging ins

Aria Operations for Logs 8.18.3 dropped earlier today, addressing several VMSAs/CVEs, all of which are documented here. The Logs 8.18.3 Release Notes can be found here. Let's apply it. Go to the Broadcom Support Portal and download it. I'm going to apply this locally via the UI. Go to Management - Cluster. Select UPGRADE CLUSTER and follows the prompts. Click UPGRADE. Accept the License Aggreement. Then just wait... My upgrade took 2-3 minutes. The About page will reflect

I wanted to pull logs from Aria Operations for Logs programatically via the API, so I went looking around for endpoints on the API surface. The first one that caught my attention was GET /events/{+path}. But whatever I tried for +path it didn't work, I continually got the missing_argument error. I didn't see any additional options on the public API, so I looked internally. The internal API can be found at https://your_logs_ip/rest-api/internal. The queries endpoint looks p

Yesterday we upgraded Aria Operations to 8.18.2, today we'll upgrade Operations for Logs to 8.18.1, which dropped along side the Operations release. Log into the Broadcom Support Portal and download the new Logs 8.18.1 binaries here. Once downloaded, log into your Logs UI and go to Management - Cluster. Click UPGRADE CLUSTER and follow the prompts. Once complete, you'll be prompted with this. Back in product you'll show Version 8.18.1 Aria Operations for Logs has now been up

The Aria Operations API is a powerful way of interacting programatically with Operations. There are several ways to authenticate with the API, let's explore them here. First, the Operations API can be accessed at the following URL: https://operations_ip_or_fqdn/suite-api The easiest way is local authentication via the Authorize button top right of the API home page, which you can do like this. The Authorize button issues a POST /suite-api/api/auth/token/acquire and caches t

The Aria Operations API gets most of the attention, but Aria Operations for Logs has a rich API surface as well, let's explore. First, your Logs API can be found at https://operations_for_logs_here/rest-api. It's a rich Swagger UI with several examples, which was introduced in 8.18 and documented by the Release Notes. First thing I noticed, is that when you attempt to authenticate via the Authorize button, you're prompted for a sessionId retrieved from /api/v2/sessions. For

Aria Operations for Logs 8.18 HF1 addresses two issues and 40 CVEs, it's documented here. Downloads are available at the same link, I'll download the PAK file and apply it to my existing Logs 8.18 Cluster. First, take Snapshots of the VMs that comprise your Logs Cluster. Once complete, log into your Logs Cluster and go to Management - Cluster. Click UPGRADE CLUSTER and select the previously downloaded PAK file. Click UPGRADE. Once complete, you'll be prompte with this. Then

Aria Operations 8.18 introduced the ability to use Cloud Proxys (CP) for log forwarding. Specifically, you can deploy a CP from Aria Operations to be used for log forwarding to Aria Operations for Logs, documentation can be found here, and here's how you do it. First, log into the Broadcom Support Portal and download the CP only package (OVA), I'm grabbing the 8.18.1 version. Once downloaded, deploy it from vCenter. At Step 9, it'll ask you for a Unique Registration Key, you

We just upgraded our Aria Suite Lifecycle Manager (ASLCM) to 8.18, which we can still do online, next we'll upgrade Operations, Logs, and Automation, but first we'll need those binaries. We can no longer download binaries directly from VMware Customer Connect, so we have to load them into ASLCM manually, here's how. Log into the Broadcom Support Portal and go to My Downloads, these are the three tiles you'll want. We're upgrading from previous releases, so we'll download the

Aria Operations for Logs 8.16.1 dropped today, here are no new features in this release, but dozens of CVEs are addressed. The formal Release Notes can be found here. Let's upgrade! As indicated in the KB above, here are the Prerequisites Create a snapshot or backup copy of the VMware Aria Operations for Logs virtual appliance(s) Obtain a copy of the VMware Aria Operations for Logs upgrade bundle .pak file for the release you are upgrading to Verify that you are logged in t

Want to send MongoDB logs to Aria Operations for logs? We can do it! In fact, we have a Content Pack for you. Go to Content Packs - Marketplace - MongdoDB Database and install the Content Pack. Once installed you'll be given Setup Instructions. Generally, Content Packs are packages of Dashboards, Queries, Alerts, Agent Groups, and Extracted Fields. We have to get the logs into Aria Operations for Logs, in this case we'll do that via Agents on the VMs hosting MongoDB. Le

Aria Operations for Logs is up and running and capturing all of your vCenter events, task, and alarms, your ESXi Host logs, and other Syslog sources. You're making notifications via email on certain logs, but not capturing all of the log fields in your email, how do you get them? Here's how! I have an Alert defined with the following query: I've chosen an arbitrary string "After request" because I know they are being generated, but this will work for whatever string you are

On February 20th the original Aria 8.16 and 8.16.1 updates were released, but we quickly pulled them due to a missing feature. They've been updated and republished, here they are! Aria Suite Lifecycle Manager 8.16 Release Notes Aria Operations 8.16.1 Release Notes Aria Operations for Logs 8.16 Release Notes Aria Automation 8.16.1 Release Notes KB with upgrade details Let's apply them. Aria Operations for Logs 8.16 needs to be done locally, let's do that one first. First do

Aria updates are here, they were released originally on 2.20.2024. Aria Operations, Aria Operations for Logs, Aria Suite Lifecycle Manager 8.16 and Aria Automation 8.16.1 dropped last week, let's upgrade! Important links here: Aria Operations 8.16 Announcement Blog Aria Operations 8.16 Release Notes Aria Operations for Logs 8.16 Release Notes Aria Automation 8.16 Release Notes Aria Suite Lifecycle 8.16 Manager Release Notes Let's get started by upgrading our Aria Suite Life

You're running a single node Aria Operations for Logs deployment and would like to expand it, let's make it a 3-node cluster (the smallest supported beyond 1), supported configurations can be found here. To do that, deploy a new Aria Operations for Logs appliance and join it to an existing deployment, documentation here. I've downloaded the appropriate binary and deployed my appliance, let's now access the UI for Setup. Click NEXT. click JOIN EXISTING DEPLOYMENT. Here you

The 8.14.1 updates to Aria Operations, Aria Operations for Logs, and Aria Automation were dropped in late November, just getting around to applying them, here's how you do it with Aria Lifecycle Manager. Log in to Aria Lifecycle Manager and check for the latest Product Support Packs via Settings - Product Support Packs - CHECK SUPPORT PACKS ONLINE. You'll find the latest available to be 8.14.0.3. Click APPLY VERSION, once done you'll have the latest. Next get the 8.14.1 binar