Aria Operations 8.18 Cloud Proxy for Log Forwarding

Aria Operations 8.18 introduced the ability to use Cloud Proxys (CP) for log forwarding. Specifically, you can deploy a CP from Aria Operations to be used for log forwarding to Aria Operations for Logs, documentation can be found here, and here's how you do it.

First, log into the Broadcom Support Portal and download the CP only package (OVA), I'm grabbing the 8.18.1 version.

Once downloaded, deploy it from vCenter.

At Step 9, it'll ask you for a Unique Registration Key, you get this from Aria Operations.

You'll notice in Step 4, I've toggled on Log Forwarding, this tells the CP to deploy as a log forwarder. While CPs can be used for both data collection (Operations) and log forwarding (Logs) we recommend dedicating your log forwarding CPs to just that.

Paste the key from Operations into the Unique Registration Key field of the OVA deployment. Once configured click NEXT.

Click finish and watch it deploy. Once deployed power it on and it'll look like this.

Back in Operations you'll see it coming online and notice that Log Forwarding is activated.

In a couple minutes it'll go online.

Once online, we can start sending Logs Agents to it, Syslog, etc. The Logs CP is aware of the Logs Cluster itself via the Operations for Logs integration, so this is required.

Next, I installed a couple vRLI Agents and configured them to send logs to this new CP, I did this by adding the following stanza at the top of /etc/liagent.ini.

[server]
;hostname is the IP of my CP for logs forwarding
hostname=10.216.178.174
ssl_accept_any=yes

You'll notice ssl_accept_any=yes, this tells the vRLI Agents, the Logs CP, and the Logs Cluster to ignore the fact that I'm using self-signed SSL Certs. Once adjusted, I started the agent with this command:

systemctl start liagentd

Once started, you'll see them come into Aria Operations for Logs.

There they are! These new powerful CPs for log forwarding are a powerful alternative to full blown Operations for Logs clusters used for log forwarding only. Today, they support Logs Agents and Syslog from ESXi Hosts (and other Syslog sources), but not vCenters, that's coming.