NSX Edge syslog service stops sending messages.

Products

• VMware NSX Data Center for vSphere

Issue/Introduction

Symptoms:

- Syslog service on edge shows as running.

- Syslog is configured for UDP. 

- NSX version is 6.4.3. 

- You can see the log on Edge: 

 >syslog-ng[862]: [xx]:  [syslog.err] I/O error occurred while writing; fd='42', error='Message too long (90)'

Environment

VMware NSX Data Center for vSphere 6.4.x

Cause

Previous syslog version had a default message size of 8k. Later versions have the default set to 65536. 

This default setting is too large for UDP log destinations, and our syslog-ng config file does not explicitly specify the message size.

Resolution

Issue is resolved on NSX 6.4.4

Workaround:

Use TCP on syslog configuration.

To work around this issue if you do not want to upgrade or use TCP, contact Broadcom Support

Additional Information

Impact/Risks:

Syslog service stops sending messages.