Need to create a parser to parse vmware aria automation logs

[rbollghub]

Note: If your issue is not a bug or a feature request, please raise a support ticket through our support portal (Splunk.com > Support > Support Portal). This will help us resolve your issue more efficiently and provide you with better assistance. For more information on how to work with the Splunk Support, please refer to this guide.

What is the sc4s version?
latest version

pcap files.txt

Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?

What the vendor name?
ARIA Applications

What's the product name?
VMWare

If you're requesting support for a new vendor, do you have any preferences regarding the default index and sourcetype for their events?
N/A - Just use existing indexes and sourcetypes for VMWare in Splunk

Do you have syslog documentation or a manual for that device??

Feature Request description:
Need to create a parser to parse vmware aria automation logs

Do you want to have it for local usage or prepare a github PR?
Local but can include in github as well

[rjha-splunk]

We recommend writing custom parsers and contributing them to the SC4S project following the guidelines provided in this article: https://splunk.github.io/splunk-connect-for-syslog/2.44.2/gettingstarted/create-parser/.
Please note that while the SC4S team will review and may integrate submitted parsers based on current priorities, we cannot provide a specific timeline for when they will be added.
Thank you for your contributions and support.

[rbollghub]

Hello, Please if the implementation of the application will take time, we need help building a parser. If you can create that parser and share, that will meet our immediate needs for the current project. We can't build the parser that is why we reached out. Please let's schedule a meeting and discuss this asap. What times are you available? I reside in the united states east coast standard time zone. v/r Seli Classification: Confidential From: Rahul Jha ***@***.***> Sent: Tuesday, May 20, 2025 6:52 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison (TCS) ***@***.***>; Author ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2750) [https://avatars.githubusercontent.com/u/90039710?s=20&v=4]rjha-splunk left a comment (splunk/splunk-connect-for-syslog#2750)<#2750 (comment)> We recommend writing custom parsers and contributing them to the SC4S project following the guidelines provided in this article: https://splunk.github.io/splunk-connect-for-syslog/2.44.2/gettingstarted/create-parser/. Please note that while the SC4S team will review and may integrate submitted parsers based on current priorities, we cannot provide a specific timeline for when they will be added. Thank you for your contributions and support. - Reply to this email directly, view it on GitHub<#2750 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLGECUJW5UOLZOE2CC327MCLZAVCNFSM6AAAAAB5G7JQ7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQOJTHA4TKOJZGE>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

[rbollghub]

Hello, We don't know how to write a correct parser. The one we wrote doesn't work and it is below. Please review and advise: block parser app-syslog-vmware_aria() { channel { rewrite { r_set_splunk_dest_default( index('netops') source('Lantronix:ConsoleFlow') sourcetype('Lantronix:ConsoleFlow:syslog') vendor('vmware') product('aria') ); }; }; }; application app-syslog-vmware_aria[sc4s-syslog-pgm] { filter { program('vcenter-server' type(string) flags(prefix)) }; parser { app-syslog-vmware_aria(); }; }; Thanks Classification: Confidential From: Rahul Jha ***@***.***> Sent: Tuesday, May 20, 2025 6:52 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison (TCS) ***@***.***>; Author ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2750) [https://avatars.githubusercontent.com/u/90039710?s=20&v=4]rjha-splunk left a comment (splunk/splunk-connect-for-syslog#2750)<#2750 (comment)> We recommend writing custom parsers and contributing them to the SC4S project following the guidelines provided in this article: https://splunk.github.io/splunk-connect-for-syslog/2.44.2/gettingstarted/create-parser/. Please note that while the SC4S team will review and may integrate submitted parsers based on current priorities, we cannot provide a specific timeline for when they will be added. Thank you for your contributions and support. - Reply to this email directly, view it on GitHub<#2750 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLGECUJW5UOLZOE2CC327MCLZAVCNFSM6AAAAAB5G7JQ7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQOJTHA4TKOJZGE>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

[nikunjj-crest]

Hi @rbollghub,

The file you shared doesn’t appear to be a valid .pcap log file and VMware Aria Automation logs. It looks more like VMware vCenter logs.

For example:

2025-02-04 12:43:21.777 cphesx085.ramboll.dk vcenter-server: Guest operation List Processes performed on Virtual machine Name
2025-02-04 12:43:21.833 sourceIP vcenter-server: Guest operation Read Environment Variables. performed on Virtual machine Name

Could you confirm is these are VMware Aria Automation logs, or they are VMware vCenter logs?

Please also share the valid .pcap file and provide more details on how these logs were collected.
For more information, you can refer to this document

[rbollghub]

Hello, Thanks for reaching out. These are VMWare Vcenter logs forwarded from VMware Aria Operations. I have shared another vcenter.pcap file for your review. v/r Seli Classification: Confidential From: Nikunj Joshi ***@***.***> Sent: Thursday, September 11, 2025 8:37 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison (TCS) ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2750) [https://avatars.githubusercontent.com/u/177525886?s=20&v=4]nikunjj-crest left a comment (splunk/splunk-connect-for-syslog#2750)<#2750 (comment)> Hi @rbollghub<https://github.com/rbollghub>, The file you shared doesn't appear to be a valid .pcap log file and VMware Aria Automation logs. It looks more like VMware vCenter logs. For example: 2025-02-04 12:43:21.777 cphesx085.ramboll.dk vcenter-server: Guest operation List Processes performed on Virtual machine Name 2025-02-04 12:43:21.833 sourceIP vcenter-server: Guest operation Read Environment Variables. performed on Virtual machine Name Could you confirm is these are VMware Aria Automation logs, or they are VMware vCenter logs? Please also share the valid .pcap file and provide more details on how these logs were collected. For more information, you can refer to this document<https://splunk.github.io/splunk-connect-for-syslog/main/create-parser/> - Reply to this email directly, view it on GitHub<#2750 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLFOWET2FK2PVZ3LYF33SFUF5AVCNFSM6AAAAAB5G7JQ7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTEOBQGQYTSNJSGY>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[nikunjj-crest]

Hi @rbollghub,

I haven’t received the vcenter.pcap file. Could you please share it again?

Thanks!

[rbollghub]

Classification: Confidential From: Nikunj Joshi ***@***.***> Sent: Friday, September 12, 2025 2:06 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison (TCS) ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2750) [https://avatars.githubusercontent.com/u/177525886?s=20&v=4]nikunjj-crest left a comment (splunk/splunk-connect-for-syslog#2750)<#2750 (comment)> Hi @rbollghub<https://github.com/rbollghub>, I haven't received the vcenter.pcap file. Could you please share it again? Thanks! - Reply to this email directly, view it on GitHub<#2750 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLGEL3PY2WX2FYDMK6T3SJPDRAVCNFSM6AAAAAB5G7JQ7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTEOBTHAZTMNRTGE>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[nikunjj-crest]

Hi @rbollghub,

I’m still not seeing the vcenter.pcap file. I’ve checked both the GitHub issue and the email, but there are no attachments. Could you please share a drive link or email me on nikunjj@splunk.com?

I have a quick question. In the issue title, you’ve mentioned VMware Aria Automation logs, but in your previous comment, you referred to them as VMware vCenter logs forwarded from VMware Aria Operations. Could you please confirm whether the logs are generated via VMware Aria Automation or VMware Aria Operations?

Additionally, it would be helpful if you could share any preferences you might have regarding the default index and sourcetype for these events.

Thanks!

[rbollghub]

vcenter_pcap.txt

I have finally attached file. Please revert if you are still having issues.

[rbollghub]

Hello, I attached the file within github ticket. Please revert if you are still having issues. ***@***.*** Classification: Confidential From: Nikunj Joshi ***@***.***> Sent: Monday, September 15, 2025 1:56 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison (TCS) ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2750) [https://avatars.githubusercontent.com/u/177525886?s=20&v=4]nikunjj-crest left a comment (splunk/splunk-connect-for-syslog#2750)<#2750 (comment)> Hi @rbollghub<https://github.com/rbollghub>, I'm still not seeing the vcenter.pcap file. I've checked both the GitHub issue and the email, but there are no attachments. Could you please share a drive link or provide the file through another method? Thanks! - Reply to this email directly, view it on GitHub<#2750 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLCFEY3NSQMWAGHCXBL3SZIIZAVCNFSM6AAAAAB5G7JQ7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTEOJQGU4TIOJRHA>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[nikunjj-crest]

Hi @rbollghub,

We already have a parser in SC4S for these logs, sourcetyped as vmware:vclog:vcenter-server. The logs you’re sending aren’t being parsed because they don’t follow the expected format, for example:

<13>1 2024-05-15T19:41:25.001Z ashesx5.Emtery.com vcenter-server: Guest operation List Processes performed on Virtual machine rwashdhcp001.

Could you check on the configuration side why the log format is incorrect and why the PRI (e.g., <13>) is being dropped from the logs?

[rbollghub]

Hello, Please can we get on a call? Until then, these logs are coming from VMWare Aria operations not VSphere v/r Seli Classification: Confidential From: Nikunj Joshi ***@***.***> Sent: Monday, September 22, 2025 6:21 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison (TCS) ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2750) [https://avatars.githubusercontent.com/u/177525886?s=20&v=4]nikunjj-crest left a comment (splunk/splunk-connect-for-syslog#2750)<#2750 (comment)> Hi @rbollghub<https://github.com/rbollghub>, We already have a parser in SC4S for these logs, sourcetyped as vmware:vclog:vcenter-server. The logs you're sending aren't being parsed because they don't follow the expected format, for example: <13>1 2024-05-15T19:41:25.001Z ashesx5.Emtery.com vcenter-server: Guest operation List Processes performed on Virtual machine rwashdhcp001. Could you check on the configuration side why the log format is incorrect and why the PID (e.g., <13>) is being dropped from the logs? - Reply to this email directly, view it on GitHub<#2750 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLDPXV67RCQULP4XFLL3T7ERFAVCNFSM6AAAAAB5G7JQ7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGMJYGA3TENBSGY>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[nikunjj-crest]

Hi @rbollghub ,

These logs are related to vCenter. Both VMware Aria Operations and VMware vSphere can produce/forward vCenter logs, which remain unchanged since they originate from vCenter. and should be tagged as vmware:vclog:vcenter-server since they relate to vCenter. If the logs include a proper PRI value and follow a valid RFC format, they will be correctly parsed by the existing parser.

I’m not a product expert, but during my research, I found this doc that VMware Aria Operations supports log forwarding to other deployments (SC4S or SIEM). Notably, Enabling the Adjust PRI/VERSION option or making similar configuration changes will prompt Aria Operations to add PRI and VERSION headers to logs that are missing them. Could you please review this and ensure the logs will be formatted according to RFC compliance?

[rbollghub]

Hello, I will review the document you attached and compare it to our current setup. In the meantime, what is the key to use? For vsphere github has the key setup for vcenter as vmware_vsphere_vc. For aria operations, is vmware:vclog:vcenter-server the key? I will revert after checking the configuration setup. Our current setup is as below: ***@***.*** v/r Seli Classification: Confidential From: Nikunj Joshi ***@***.***> Sent: Tuesday, September 23, 2025 7:15 AM To: splunk/splunk-connect-for-syslog ***@***.***> Cc: Seli Agbolosu-Amison (TCS) ***@***.***>; Mention ***@***.***> Subject: Re: [splunk/splunk-connect-for-syslog] Need to create a parser to parse vmware aria automation logs (Issue #2750) [https://avatars.githubusercontent.com/u/177525886?s=20&v=4]nikunjj-crest left a comment (splunk/splunk-connect-for-syslog#2750)<#2750 (comment)> Hi @rbollghub<https://github.com/rbollghub> , These logs are related to vCenter. Both VMware Aria Operations and VMware vSphere can produce/forward vCenter logs, which remain unchanged since they originate from vCenter. and should be tagged as vmware:vclog:vcenter-server since they relate to vCenter. If the logs include a proper PRI value and follow a valid RFC format, they will be correctly parsed by the existing parser. I'm not a product expert, but during my research, I found this doc<https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations-for-logs/8-16/aria-operations-for-logs-8-16/configuring-vrealize-log-insight/add-a-log-forwarding-destination.html> that VMware Aria Operations supports log forwarding to other deployments (SC4S or SIEM). Notably, Enabling the Adjust PRI/VERSION option or making similar configuration changes will prompt Aria Operations to add PRI and VERSION headers to logs that are missing them. Could you please review this and ensure the logs will be formatted according to RFC compliance? - Reply to this email directly, view it on GitHub<#2750 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4U3DLAUUR5M4MLDVYWOVCT3UETT3AVCNFSM6AAAAAB5G7JQ7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGMRTGU2TIMZTHA>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>