VMware Cloud Community
Patrick490
Contributor
Contributor
‎06-20-2017 03:00 AM

duplicate host entry for VCSA

After Migration of vCenter Server (Windows) to VCSA (Appliance), I do see the VCSA twice in Log Insight under hosts.

1. hostname (vcsa)

2. fqdn (vcsa.domain.local)

any idea why is this? both entries can communicate events and so it takes 2 licenses for same vCenter!

0 Kudos
3 Replies
admin
Immortal
Immortal
‎06-20-2017 09:02 AM

Does one of them (the older one for windows) show the last received event as an older date than the new one in the hosts table?

0 Kudos
Patrick490
Contributor
Contributor
‎06-21-2017 12:25 AM

both have same date. events received 5 Minutes ago.

0 Kudos
admin
Immortal
Immortal
‎06-21-2017 05:59 AM

There are three likely culprits:

  • Mixing vSphere Integration with Agent/Syslog. Perform a query in Interactive Analytics for: hostname contains (vcsa)( (vcsa.domain.local). In the top chart, group by Source, Hostname and Appname, not over time. Do the events from each hostname also appear to originate with different a appname (e.g., vcsa produces events from "vcenter-server" while vcsa.domain.local produces events from "vpxd")? The events with appname=vcenter-server originate from the vSphere Integration feature.

  • Reverse DNS sometimes reports different hostnames. Does a reverse-dns lookup of the IP address of your VCSA machine, from the perspective of your Log Insight node (console or ssh, login as root) return the short or long name?

  • Inconsistent self-reported hostnames. Log messages are capable of including a hostname within the body. It is possible two applications on the source are injecting different hostnames into their logs. Can you identify a pattern of the kinds of logs (e.g., using Event Types) produced with each distinct hostname?
0 Kudos