Missing remote logging server alarm

VMware NSX

Title: Alarm for logging.missing_remote_logging_server
Event ID: logging.missing_remote_logging_server

Alarm Description

Purpose: Indicates whether a remote logging server is configured.
Impact: There is limited disk space on nodes to store log messages. Log rotation is used to limit the amount of space each log file consumes. If a remote logging server is not configured, then the rotated log messages are lost which makes it difficult to triage issues.

VMware NSX 4.1.2 and above

The alarm is raised to highlight that the appliance(s) do not have a remote logging server configured.

Disk space on the appliances is limited, as such the logs need to be rolled over, to prevent disk space exhaustion.

if an issue occurs in the past and the logs have rolled over, there may be no or not enough data to help identify why the issue occurred.

This may be the desired state, you do not wish to configure a remote logging server and if that is the case, the alarm should be acknowledged.

Steps to resolve
For version 4.1.2 and above

Recommended Action:

Invoke API GET /api/v1/configs/central-config/logging-servers to see the nodes on which remote logging is not configured.
For NSX Manager, Global Manager and Edge nodes, use NSX CLI set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> to configure a remote logging server and use NSX CLI get logging-servers to confirm if a remote logging server has been configured.

Note: Choose the logging level based on the user requirements to avoid full the remote logging server's disk space. Valid logging level operation includes: emerg, alert, crit, err, warning, notice, info, debug.
For ESXi nodes, use ESXi CLI esxcli system syslog config set --loghost=<str> and then esxcli system syslog reload to configure a remote logging server and use ESXi CLI esxcli system syslog config get and check Remote Host in response to confirm if the remote logging server has been configured.
If your setup only contains NSX Manager and Edge nodes, it is recommended to use Node Profile to configure the remote logging server. Go to System | Fabric | Profiles | Node Profiles | All NSX Nodes and configure the remote logging server in the Syslog Servers section. The configuration will be applied on all NSX Manager and Edge nodes.

Maintenance required for remediation? No