vDefend / Avi Alarm: Remote syslog server logging is down.

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

You are running SSP, License Hub for vDefend and Avi, or Avi Operations and have encountered an alarm with the description:

"Remote syslog server logging is down."

Environment

vDefend SSP Version: 5.0 and later
License Hub for vDefend and Avi: 2.0 and later
Avi Operations: 5.2 and later

Cause

• Network Connectivity Issues: The Fluentd pod cannot reach the remote syslog server due to network disruptions or misconfigurations.
• Remote Server Downtime: The remote syslog server itself could be experiencing downtime.

Resolution

1. Check network connectivity

Confirm that firewall rules, routing, and DNS allow traffic from the appliance VM to the remote syslog server.

2. Review Fluentd logs

From the appliance VM, as root(5.0) or sysadmin(5.1 and above):

k logs fluentd-0 -n nsxi-platform

Errors such as the following indicate that Fluentd cannot reach the syslog server and its buffer has filled:

failed to emit data to remote syslog
failed to write data into buffer by buffer overflow action
failed to flush the buffer
buffer is full

3. Verify remote syslog server health

Confirm the server is running, reachable, and accepting connections, and that the rsyslog configuration and listening ports are correct and not blocked by a firewall.

For TLS connections, validate from the appliance VM as root(5.0) or sysadmin(5.1 and above):

openssl s_client -connect <remote_syslog_server>:<tls_port> -CAfile <ca_certificate.pem> -showcerts -msg

The CA certificate is the .pem file uploaded through the SSP UI when the syslog server was configured. It is stored in the Fluentd pod and can be verified with:

k -n nsxi-platform exec -it fluentd-0 -- bash
cat /opt/bitnami/fluentd/syslog/ca-cert.pem

For TCP/UDP connections, test from the cluster-api pod:

k exec -it deploy/cluster-api -c cluster-api -- bash
nc -zvu <remote_syslog_server_ip> 514

Use nc -zv (without -u) to test a TCP port.

4. Additional remediation

• Remove the existing syslog configuration and re-add it, then confirm whether log transmission resumes.
• If connectivity has been restored but Fluentd still reports a full buffer, delete the Fluentd pod to recreate it and clear the buffer condition:

k delete pod fluentd-0 -n nsxi-platform