NSX Logs show IP address instead of FQDN in Explore Logs page when using LI-TLS Syslog Protocol

Products

• VCF Operations

Issue/Introduction

After configuring NSX Managers to send logs to Aria Operations for Logs using the LI-TLS syslog protocol, administrators may observe that the Explore Logs page displays the IP address of the NSX appliance in the chart at the top instead of the FQDN, even when filtering logs using the NSX Manager FQDN

Environment

Aria Operations for logs 8.18.x
VMware NSX 4.x 

Cause

This behavior occurs due to differences in syslog message formatting between protocols:

• The UDP syslog protocol sends logs where the source field contains the NSX appliance FQDN

• By default, the LI-TLS syslog protocol sends logs where the source field contains the IP address of the NSX appliance

Aria Operations for Logs displays the source information exactly as it is received in the log payload.

Resolution

To display the NSX appliance FQDN instead of the IP address in the Explore Logs page:

1. Reconfigure the NSX appliance remote syslog settings

2. Change the syslog protocol from LI-TLS to UDP

3. Save the configuration and allow new logs to be ingested

For detailed steps, refer to the official NSX Remote Syslog Configuration documentation.