[VMC on AWS] How to forward "L2VPN session DOWN" log from NSX Autonomous Edge to vRealize Log Insight Cloud

Products

• VMware Cloud on AWS

Issue/Introduction

This article provides information about forwarding logs from NSX Autonomous Edge to vRealize Log Insight Cloud.

Symptoms:
When a user attempts to forward the "L2VPN session DOWN" logs from NSX Autonomous Edge to vRealize Log Insight Cloud, the log is not forwarded. The log forwarding settings in NSX Autonomous Edge are as follows.

set logging-server <cloud proxy IP address> proto udp level warning facility local6

Cause

The log facility should be system daemons (LOG_DAEMON), not local6.

Resolution

Execute  the following command.

set logging-server <cloud proxy IP address> proto udp level warning facility daemon

This log excerpt is an example: 

<DATE>T<TIME>+00:00 nae01 NSX 1930 FABRIC [nsx@6876 comp="nsx-edge" subcomp="datapathd.l2event(dp-ipc6)" level="WARN" eventId="vmwNSXVpnL2SessionStatus"] {"event_state":0,"event_external_reason":"L2VPN session DOWN","event_src_comp_id":"XXXX-XXXX-XXXX-XXXX-XXXX","event_sources":{"id":"XXXX-XXXX-XXXX-XXXX-XXXX"}}