VMware Cloud Community
Patrick490
Contributor
Contributor

duplicate host entry for VCSA

After Migration of vCenter Server (Windows) to VCSA (Appliance), I do see the VCSA twice in Log Insight under hosts.

1. hostname (vcsa)

2. fqdn (vcsa.domain.local)

any idea why is this? both entries can communicate events and so it takes 2 licenses for same vCenter!

Reply
0 Kudos
3 Replies
admin
Immortal
Immortal

Does one of them (the older one for windows) show the last received event as an older date than the new one in the hosts table?

Reply
0 Kudos
Patrick490
Contributor
Contributor

both have same date. events received 5 Minutes ago.

Reply
0 Kudos
admin
Immortal
Immortal

There are three likely culprits:

  • Mixing vSphere Integration with Agent/Syslog. Perform a query in Interactive Analytics for: hostname contains (vcsa)( (vcsa.domain.local). In the top chart, group by Source, Hostname and Appname, not over time. Do the events from each hostname also appear to originate with different a appname (e.g., vcsa produces events from "vcenter-server" while vcsa.domain.local produces events from "vpxd")? The events with appname=vcenter-server originate from the vSphere Integration feature.

  • Reverse DNS sometimes reports different hostnames. Does a reverse-dns lookup of the IP address of your VCSA machine, from the perspective of your Log Insight node (console or ssh, login as root) return the short or long name?

  • Inconsistent self-reported hostnames. Log messages are capable of including a hostname within the body. It is possible two applications on the source are injecting different hostnames into their logs. Can you identify a pattern of the kinds of logs (e.g., using Event Types) produced with each distinct hostname?
Reply
0 Kudos