Remote Logging Not Configured alarm

VMware NSX

Title: Alarm for Remote Logging Not Configured
Event ID: logging.remote_logging_not_configured

Alarm Description

Purpose: Indicates if remote logging server is not configured for NSX appliances or the ESX hosts.
Impact: There is limited disk space on nodes to store log messages. Log rotation is used to limit the amount of space each log file consumes. If a remote logging server is not configured, then the rotated log messages are lost which makes it difficult to triage issues.

VMware NSX 4.1.2 and above

The alarm is raised to highlight that the appliance(s) or the ESX hosts do not have remote logging server configured.

Disk space on the appliances is limited, as such the logs need to be rolled over, to prevent disk space exhaustion.

if an issue occurs in the past and the logs have rolled over, there may be no or not enough data to help identify why the issue occurred.

This may be the desired state, you do not wish to configure a remote logging server and if that is the case, the alarm should be acknowledged.

Steps to resolve
For version 4.1.2 and above

Recommended Action:

Invoke API GET /api/v1/configs/central-config/logging-servers to see the nodes on which remote logging is not configured.
It is recommended to use Node Profile to configure the remote logging server. Go to System -> Fabric -> Profiles -> Node Profiles -> All NSX Nodes and configure the remote logging server in the Syslog Servers section. The configuration will be applied on all NSX Manager and Edge nodes.
Alternatively For NSX Manager, Global Manager and Edge nodes, use NSX CLI set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> to configure a remote logging server and use NSX CLI get logging-servers to confirm if a remote logging server has been configured.

Note: Choose the logging level based on the user requirements to avoid full the remote logging server's disk space. Valid logging level operation includes: emerg, alert, crit, err, warning, notice, info, debug.
For ESXi nodes, use ESXi CLI esxcli system syslog config set --loghost=<str> and then esxcli system syslog reload to configure a remote logging server. Use ESXi CLI esxcli system syslog config get to confirm the configuration. See Configuring Syslog on ESXi.

Maintenance required for remediation? No