VMware Aria operation storage/core drive full 97%

[Pravin Bargal]

our VMware Aria Operations for Logs (Version 8.12.0-22156412) is experiencing several problems: Partition /storage/core is 100% full, slow performance, configuration on the GUI is not possible since one or two members are not responding, etc...

 

In the near past we added 3 additional vCenters as log sources with 40 ESXi approx.

 

Another change done was to renew the certificate in 2 vCenters: 

 

We suppose the cause is that there list to much log input.

 

Also se the storage/core disck full 97% 

 

Which option we can consider as below,

- to increase the capacity a new vdisk can be added: Increase the Storage Capacity of the VMware Aria Operations for Logs Virtual Appliance

 

-  to archive the older logs, but for that we have to prepare a NFS share destination.

 

- to reduce the retention time and force some log rotation resulting in the free of space

 

- to control/priorize/reduce the log input somehow

[Shen88]

@Pravin Bargal,

Please note this is an expected behavior that the /storage/core partition is at 97%. So, values of higher than 97% indicate a possible issue with the Aria Operations for Logs virtual appliance.

Aria Operations for Logs will check this partition every minute to ensure free disk space is not less than 3%. If the free disk space drops below 3%, old data buckets are retired. However, if the log ingestion rate is higher than 3% of total disk capacity per minute, the appliance runs out of disk space.

Also, from my experience sizing is most important for you to determine the Preset size (Small, Medium or Large) for VMware Aria Operations for Logs virtual appliance (Page 12)
https://docs.vmware.com/en/VMware-Aria-Operations-for-Logs/8.12/Getting-Started-Operations-for-Logs.pdf

Also, please refer this article to get an spreadsheet downloaded or use vrlisizer.vmware.com to determine how much network/storage utilisation will be required.

Please find my answers inline.

-  to archive the older logs, but for that we have to prepare a NFS share destination.
Yes an NFS share is required to enable archiving of logs which is a good practice to do unless the logs are not required, Aria Operations for Logs archives the bucket before retiring it. If the free disk space is filled before the old bucket is archived and retired, the Aria Operations for Logs virtual appliance also runs out of disk space.

- to reduce the retention time and force some log rotation resulting in the free of space
Yes, this is a sensible decision to make. A retention period is determined by the amount of data the system can hold and the current ingestion rate. For example, if you are receiving 10 GB/day of data (after indexing) and you have 300 GB of space, then your retention rate is 30 days. When your storage limit is reached, old data is removed to make way for newly ingested data.
 

- to control/priorize/reduce the log input somehow
Yes, when you follow sizing guidelines; you will find the 'Events per second' you are expecting to be ingested into Aria operations for logs so you could plan for this in advance.

------------------------------
If you find this answer right, please 'Recommend' this post.

Thank you!

Regards,
Shen
------------------------------

[Pravin Bargal]

@shen88,

Thanks for help and your solution is work