Impact of Aria Operations for Logs Restart on Syslog Forwarding from NSX Nodes

Products

• VMware NSX
• VMware Aria Operations (formerly vRealize Operations) 8.x

Issue/Introduction

When Aria Operations for Logs is shut down for maintenance or a restart, administrators may inquire if syslog messages generated by VMware NSX nodes during the downtime will be buffered and re-transmitted once the service is restored.

Environment

VMware NSX
VMware Aria Operations for Logs

Cause

If the protocol specified for the NSX node is TCP or UDP, it is expected that the NSX node logs will not be forwarded while the Aria Operations for Logs server is shut down. If the LI protocol is specified, due to the local buffer mechanism, there is a possibility that the loss of log forwarding from the NSX node will be reduced compared to the TCP or UDP protocols.

Resolution

To ensure no critical log data is missed during planned maintenance of Aria Operations for Logs, follow these recommendations:

1. Verify Configured Protocol: Check the NSX node profiles to identify if UDP, TCP, or LI is in use.
2. Planned Log Retrieval: If logs from the downtime period are required for troubleshooting or audit purposes, manually collect a log bundle from the NSX Manager or relevant Edge nodes immediately after maintenance.
3. Use LI Protocol: Where possible, configure NSX nodes to use the LI protocol to leverage its local buffering capabilities, though total recovery is not guaranteed for long outages.