When configuring IDFW Event Server an unknown error is seen due to incorrect parsing of the event record id. This issue occurs if the received event record id is a long value.
Resolution
This issue is resolved in VMware NSX-T Data Center 3.2.0.1 This issue is resolved in VMware NSX-T Data Center 3.2.1.0 This issue is resolved in VMware NSX 4.0.0
Workaround: VMware Tools introspection module can be used as an alternative login detection mechanism when Event Server cannot be configured. If this is not an viable workaround, please open a Support Request with VMware Support to discuss other options.