VMware Aria operations for Logs do not receive NSX Distributed Firewall Logs.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• NSX not forwarding Distributed Firewall (DFW) logs to Aria Operations for Logs. Showing "No results" in "NSX - Distributed Firewall - Traffic" Dashboard.
  
  
• Validate Syslog Host "Syslog.global.logHost" configured on ESXi Host under Advanced system Settings in vCenter Server to send logs to Aria Operations for Logs endpoint.
  
  

Environment

Aria Operations for Logs 8.18.x

Cause

There is no network connectivity between ESXI host and Aria Operations for Logs.

Resolution

ESXI host should be able to reach Aria Operations for Logs over 514 port.

nc -z  #.#.#.# 514

Additional Information

Please refer below KB article to configure Syslog Log Host on ESXI host.

NSX Distributed Firewall (DFW) logs are not forwarding to Aria Operations for Logs