Unable to export Firewall Logs from an Edge Gateway which has a large number of rules and logs as it never completes

Products

• VMware Cloud Director

Issue/Introduction

• When attempting to export firewall logs as CSV from the VMware Cloud Director(VCD) UI, the export process does not complete successfully.
• The loading bar remains active for an extended period but the export of logs never completes even when the selected date range is as short as 30 minutes.
• VCD session times out when trying to download Firewall logs from Edge Gateway.

Environment

VMware Cloud Director 10.6.1.1

Cause

This is a known limitation in current versions of VCD. During data export operations, the VCD UI executes a client-side pagination loop against the backend API. Upon receiving the initial response payload, the UI evaluates the total-page-count metadata and sequentially dispatches asynchronous API calls to retrieve all subsequent pages (e.g., issuing 99 additional requests for a 100-page dataset). When exporting excessively large datasets, this continuous polling mechanism saturates client-side browser resources and network queues, ultimately resulting in a UI freeze or session unresponsiveness.

Resolution

To retrieve the logs use the API. VCD's native API Explorer or any third party API client can be used for this purpose.

Edge Gateway

1. Open VCD Tenant UI and navigate to (?) -> API Explorer.
   
   Note: If a tenant user does not have access to API Explorer then they can have it added as outlined in: API Explorer (Swagger) not visible for Organization Administrator / Custom Roles
2. Locate this API:
   
   GET /2.0.0/edgeGateways/{gatewayId}/firewall/logs
   
   
3. Click Try It Out.
4. In the gatewayId field enter the Edge ID. This ID can be found by clicking the on the Edge in the VCD UI, then examine the Address URL bar on the Web Browser.
   
   Example: urn:vcloud:gateway:##########-####-####-####-############
   
   
5. Filters can optionally be applied in the 'filter' textbox to limit time ranges. 
   
   Sample filter: timestamp=gt=2026-06-08T00:00:00.000Z,timestamp=lt=2026-06-09T00:00:00.000Z
   
   
6. Click Execute and wait for the response.

Data Center Group with Distributed Firewall

1. Open VCD UI and navigate to (?) -> API Explorer.
2. Get the list of vdcGroups using the API.
   
   GET /1.0.0/vdcGroups
   
   
3. From the output, document the vdcGroupId of the vdcGroup.
4. Query the following API using the vdcGroupId identified in step 3.
   
   GET /1.0.0/vdcGroups/{vdcGroupId}/dfwPolicies
   
   
5. From the output, document the ID of the policy.
6. Locate this API in the dfwPolicy section.
   
   GET: /1.0.0/vdcGroups/{vdcGroupId}/dfwPolicies/{policyId}/logs
   
   
7. Click Try It Out.
8. In the vdcGroupId field enter the vdcGroupId identified in step 3.
   
   Example: urn:vcloud:vdcGroup:##########-####-####-####-############
   
   
9. In the policyId field enter the ID identified in step 5.
10. Filters can optionally be applied in the 'filter' textbox to limit time ranges. 
    
    Sample filter: timestamp=gt=2026-06-08T00:00:00.000Z,timestamp=lt=2026-06-09T00:00:00.000Z
    
    
11. Click Execute and wait for the response.
    
    For more information you can refer the document for API endpoint: https://developer.broadcom.com/xapis/vmware-cloud-director-openapi/latest/cloudapi/1.0.0/vdcGroups/vdcGroupId/dfwPolicies/policyId/logs/get/