Syslog Exporter Configuration Cleared After Using Node Profile (Central Node Config) in NSX

Products

• VMware NSX

Issue/Introduction

The local syslog configuration on NSX Manager or Edge nodes may be unexpectedly removed. This typically occurs after administrators use Node Profile (Central Node Config) to configure other settings such as NTP or SNMP through the NSX UI.

• Syslog exporter configuration disappears from NSX Manager or Edge nodes.

• /var/log/syslog shows Error like below "NSX 2XXXX2 - [nsx@XXXX comp="nsx-manager" subcomp="central_node_config_update" username="root" level="INFO"] Updating Syslog configuration"

• CLI syslog configuration is removed or overwritten.

• Issue occurs shortly after Node Profile settings were changed via the NSX UI.

• Central Config API shows syslog exporter list as empty ([]).

Example API call:

GET /api/v1/configs/central-config/node-config-profiles/00000000-0000-0000-0000-000000000001

The returned JSON contains:

Environment

NSX 4.x

VCF 9.X

Cause

This behavior occurs because the Node Profile UI writes an empty list ([]) for the syslog exporter field in Central Config, which NSX then interprets as a request to remove syslog configuration from all nodes.

Resolution

There are two recommended approaches:

Option 1: Remove syslog field from Central Config and configure syslog locally

1. Retrieve the current Node Profile payload:

   GET /api/v1/configs/central-config/node-config-profiles/00000000-0000-0000-0000-000000000001

2. Remove the entire "syslog" field from the JSON.

   Example cleaned payload:

   {
     "ntp": { ...unchanged... },
     "snmp": { ...unchanged... },
     "resource_type": "CentralNodeConfigProfile",
     "id": "00000000-0000-0000-0000-000000000001",
     "display_name": "All NSX Nodes",
     "description": "All configurations in this profile are applied to Manager and Edge nodes.",
     "_create_time": <Keep same as is get call>,
     "_last_modified_user": "<Keep same as is get call>",
     "_last_modified_time": <Keep same as is get call>,
     "_create_user": "system",
     "_system_owned": false,
     "_protection": "NOT_PROTECTED",
     "_revision": 5
   }

3. Push the cleaned payload:

   PUT /api/v1/configs/central-config/node-config-profiles/00000000-0000-0000-000000000001

4. Reconfigure syslog locally on each node via CLI.

It will no longer be overwritten by Central Config.

Option 2: Manage syslog centrally using Node Profile

If customers prefer central management:

• Reconfigure the syslog exporter directly in Node Profile (Central Node Config).

• All nodes will inherit syslog configuration from the profile.