NSX and Log Insight

[santunez2275]

Hello Guys

NSX 6.3.5 and Log Insight 4.5.1 were installed. NSX was configured to send log to Log Insight, but in Dashboard it does not show data of Logical Switch Created.

NSX was configured to send log to Log Insight, but in Dashboard it does not show data of Logical Switch Created, Logical Routers, always shows in zero and have Logical Switch and Logical Routers actives.

The only thing that shows us dashboard is Edge Firewall.

How can you validate that the logs are being sent correctly to Log Insight?

Regards

[bayupw]

Hi Sebastian,

Make sure you have forwarded all the required components to the Log Insight:

1. ESXi Host Logs

2. NSX Manager Logs

3. NSX Controller Logs

4. NSX Edge Logs

Then check if you can see the logs are being forwarded to the Log Insight.

You can refer to this doc (About NSX Logs) on how to specify syslog server for each components

Or these 2 blog posts

Integrate VMware NSX in Log Insight | Virten.net

https://esxsi.com/2017/02/09/nsx-log-insight/

[amolnjadhav]

Hi,

Even i have faced this issue in my envornment.

Please configure syslog server "vRLI" ip address in each esx host this should reslove your issue.

[Mparayil]

Hello,

Let me know if you are still having this issue we can work on this,

[santunez2275]

Hello

The problema persist. I changed fqdn by IP but not receive events.

Regards.

Sebastian

[Mparayil]

Are you able to see all the vSphere components like ESxi host etc.., for me it looks like NSX manger is not sending the logs to the Login sight, when we create a Logical switch or any thing the logs needs to be forward to the Log insight from that log event it takes the number of creation events and mentions on the Login sight dash board.

can you UNconfigure the Syslog server on the NSX manger and reconfigure it.

I am checking the working setup logs to identify the issue.

I will get back to you !

[Mparayil]

ON NSX manger try to register thhe Syslog details with IP address and select UDP port 514

[srodenburg]

Forget about the dashboards for a second. In LI, under "Interactive analysis", when you filter on source, do you see anything arriving at all, from all the hosts that you expect (have configured) ?

If that does not work, forget any further steps and fix that first.