Distributed Firewall (DFW) logs are intermittently missing or show "No Logs Found" in VMware Cloud Director UI

Products

• VMware Cloud Director

Issue/Introduction

• Distributed Firewall (DFW) logs are intermittently missing in the VMware Cloud Director (VCD) interface.
• UI displays a "No Logs found" message.
• Logs are visible within Aria Operations for Logs (formerly vRealize Log Insight) Interactive Analytics.
• VCD cells show HTTP 200 responses for log queries, but no data is rendered.

Environment

• VMware Cloud Director 10.6.x
• Aria Operations for Logs 8.18.x
• NSX-T Content Pack 4.0.2 or earlier

Cause

The issue is attributed to two primary factors:

1. Metadata Tagging Limitation: Older versions of the NSX-T Content Pack fail to properly tag log entries with the mandatory vmw_nsxt_firewall_ruleid metadata required by VCD.
2. Software Query Limitation: A limitation within the Aria Operations for Logs query processing engine regarding how VCD-embedded queries are handled.

Resolution

This issue is targeted to be fixed in a future release. Subscribe to this article to be updated on the fix status.

To mitigate the behavior:

1. Navigate to the Content Pack Marketplace in Aria Operations for Logs.
2. Upgrade the NSX-T Content Pack to version 4.1 or later. This ensures the vmw_nsxt_firewall_ruleid field is correctly populated.
3. Verify that logging is enabled on specific Distributed Firewall rules in VCD.
4. Verify ESXi hosts are configured to forward syslog data to Aria Operations for Logs.
5. From the VCD cells, verify API connectivity to Aria Operations for Logs:

   curl -k -X POST https://<Aria_Logs_FQDN_or_IP>:9543/api/v2/sessions -d '{"username":"<username>", "password":"<password>", "provider":"Local"}'

Note: These steps serve as prerequisites and validation checks while the permanent fix is being incorporated into a future VCD release.

Additional Information

If "No Logs Found" persists after the Content Pack upgrade, verify that logging is explicitly enabled on the specific Distributed Firewall rules in VCD and that the Host Transport Nodes (ESXi) are configured to forward syslog data to Aria Operations for Logs.