How to review DFW logs for any "DENY" entries

Products

• VMware NSX

Issue/Introduction

• Breakdown in communication occurred between apps running on NSX overlay segments. 
• DFW rules have "logging" enabled. 
  
• Application teams are suspecting DFW drops impacting communication.

Environment

VMware NSX 

Resolution

• DFW logging can found on the ESXi host where source/destination VM resides. 
  • PATH: /var/log/dfwpktlogs.log
• The below document should be reviewed for a list of DFW log variables and their possible values. 
  
  • Distributed Firewall Packet Logs