Updated: 04/15/2025
Editorial Note: this is a living blog featuring important service updates for VMware Cloud on AWS logs. Please check back frequently for the latest updates and additional answered FAQs. As this feature is in active development, all information in this document is subject to change.
What is Changing?
In August 2024, VMware Cloud on AWS (VMC) customers were notified that Aria Operations for Logs SaaS would be shut down. In December 2024, we updated the announcement to clarify that active VMC customers would have their time on Aria Operations for Logs SaaS extended. Active VMC customers currently continue to have access to Aria Operations for Logs SaaS, but this service will be undergoing significant changes over the next few months that customers need to prepare for.
Today, we are announcing that Aria Operations for Logs SaaS will be deprecated as a log analysis and archival tool, but log forwarding functionality will remain available for VMC customers to forward their SDDC logs. VMC customers will be able to configure log forwarding for their SDDC audit logs to any supported endpoint. Customers can then configure a logging tool/solution of their choice to store and analyze the logs. The logging solution for log storage and analysis must be independently acquired and is not included with VMware Cloud on AWS.
As part of this change, VMC will introduce an updated log forwarding UI from within the existing Aria Operations for Logs SaaS console on May 1, 2025. Customers will have 90 days, until July 31, 2025, to create new log forwarding configurations. The full Aria Operations for Logs SaaS product experience will remain available until July 31, 2025, but after that date, customers will only have access to log forwarding configurations, log forwarding agents, system alerts, and API keys. All other product functionality, including access to indexed and non-indexed partitions, will be removed. This update is only applicable to the VMware Cloud on AWS commercial service.
Frequently Asked Questions
1. What is changing with log consumption for VMware Cloud on AWS?
The exception allowing VMware Cloud on AWS customers continued access to Aria Operations for Logs SaaS will end on July 31, 2025. However, VMC customers will be able to continue using log forwarding functionality within Aria Operations for Logs SaaS to send their SDDC audit logs to any supported endpoint. Customers can then use their own solution to collect and process/store those logs. As part of this change, the Aria Operations for Logs SaaS UI will include new menu items, available on May 1, 2025, for customers to make new log forwarding configurations which must be created using the updated interface. The remaining product functionality will be marked as deprecated and then removed on July 31, 2025.
2. Will VMware Cloud on AWS provide a replacement tool to store and analyze SDDC logs?
No, VMC will only provide log forwarding for SDDC audit logs. Customers must provide their own tool to subsequently collect and process/store their SDDC logs. To avoid losing access to their SDDC logs, customers must configure new log forwarding and have a logging solution by July 31, 2025.
3. What specific logs will be available for forwarding?
The following logs will be available for forwarding: SDDC audit logs generated by ESXi, vCenter, and NSX as well as VMC Activity and Notification logs. Log ingestion from customer applications or other sources will not be available for forwarding, only the SDDC audit and VMC service logs listed above.
4. What are the supported log forwarding endpoints?
Customers can configure log forwarding to the following endpoints:
- Cloud: Amazon S3 buckets
- Cloud: HTTP
- Cloud: Splunk
- On-premises: Aria Operations for Logs*
- On-premises: Splunk*
- On-premises: UDP*
- On-premises: TCP*
* Requires the new VMware Cloud Logs Agent
5. Will the Cloud Proxy be available?
The existing Cloud Proxy will be replaced by the new VMware Cloud Logs Agent, with similar functionality available for on-premises endpoints. The agent offers log aggregation and configuration management capabilities and can be configured to forward logs to supported endpoints, including VMware Aria Operations for Logs. The Log Agent is a Docker container that can be installed on any suitable docker host, including physical, on-premises VM, or Cloud VM. VMC will provide instructions for how to configure the agent on a Photon 5-based OS, and similar steps can be followed if customers prefer to deploy in a different OS. In-product instructions will be available for configuring the new VMware Cloud Logs Agent on May 1, 2025.
6. What product functionality will remain available in the Aria Operations for Logs SaaS Console after July 31, 2025?
Customers will have the following product functionality available starting in May 2025 and available after July 31, 2025:
- Log Forwarding Configurations: Customers will be able to configure forwarding rules to send logs to supported endpoints.
- Log Forwarding Agents (on-premises only): Customers can view all registered on-premises log forwarding agents.
- System Alerts: Customers can configure system alerts for their log forwarding configurations.
- API key Management: Customers can manage API keys for their use of log forwarding configurations.
7. What happens to the remaining product functionality within the Aria Operations for Logs SaaS console?
The remaining product functionality in Aria Operations for Logs SaaS Console, including the ability to create indexed and non-indexed partitions, analyze logs, and all other product functionality will be deprecated and no longer available for customer use after July 31, 2025. Additionally, log ingestion from customer applications or other sources will not be available for analysis or forwarding, and we will disable all previous log forwarding configurations and API keys after July 31, 2025. Customers will need to configure new forwarding configurations prior to July 31, 2025.
8. How long will logs be retained if they are not configured for forwarding?
Customers will have their existing Aria Operations for Logs retention until July 31, 2025. After July 31, 2025, Logs will be retained in the Aria Operations for Logs service for customer forwarding for 7 days. After 7 days, older logs will no longer be available. These logs cannot be viewed or accessed through the Aria Operations for Logs SaaS UI; they must be forwarded to another solution. Customers need to configure forwarding if they want to retain and analyze their logs. Additionally, we will disable all previous log forwarding configurations and API keys after July 31, 2025, so customers will need to configure new forwarding configurations using the new UI menu prior to July 31, 2025.
9. Can customers export their existing logs from indexed or non-indexed partitions?
Logs stored in indexed partitions expire after 30 days, so these will automatically expire within the 90 day period. We are providing 90-day notice so that customers can appropriately configure forwarding of their logs. For logs stored in non-indexed partitions, please submit a service request to receive assistance in retrieving logs stored in non-indexed partitions. After July 31, 2025, indexed and non-indexed partitions will no longer be available to customers.
10. I already have log forwarding configured and I am using a 3rd party log analysis tool. Do I need to do anything?
As part of this change, VMC will introduce an updated log forwarding UI from within the existing Aria Operations for Logs SaaS console on May 01, 2025. Customers will have 90 days, until July 31, 2025, to create new log forwarding configurations. Customers must replace their existing configurations using the new log forwarding UI by July 31, 2025. Additionally, if required, new API keys will need to be generated and customers who use the Cloud Proxy will need to transition to the new VMware Cloud Logs Agent.
11. When does this transition to the new logging solution start and when must customers complete their transition from Aria Operations for Logs SaaS?
VMC will introduce an updated log forwarding UI from within the existing Aria Operations for Logs SaaS console on May 1, 2025. Customers will have 90 days, until July 31, 2025, to create new log forwarding configurations and provide their own solution to process/store their SDDC logs. We will disable all previous log forwarding configurations and API keys after July 31, 2025, as well as the remaining functionality within the Aria Operations for Logs SaaS UI.
