Gateway Firewall Logs Missing in VMware Cloud Director Tenant UI

Products

VMware Cloud Director

Issue/Introduction

Users are unable to view Gateway Firewall logs from within the VMware Cloud Director (VCD) UI.
Distributed Firewall logs are successfully visible in both VCD and the integrated VMware Aria Operations for Logs (VRLI) instance, but Gateway Firewall logs are missing completely from both.

Environment

VMware Cloud Director 10.6
VMware NSX 4.2
VMware Aria Operations for Logs 8.18

Cause

A network connectivity issue prevents the NSX Edge node from sending syslog data to VMware Aria Operations for Logs.

Resolution

While Distributed Firewall logs are processed and forwarded directly from the ESXi host, Gateway Firewall logs are generated on and sent directly from the NSX Edge node. If the NSX Edge node lacks network reachability to the syslog server, VRLI will not receive the data, and VCD will be unable to display the logs in the tenant UI.

Verify product version compatibility according to the Broadcom Interoperability Matrix
Verify network routing and connectivity between the NSX Edge nodes (hosting the Tier-1/Tier-0 gateways) and the VRLI appliance.
Ensure that the required syslog ports (UDP 514, TCP 514, or TCP 6514 for TLS) are open on any physical or virtual firewalls sitting between the NSX Edge nodes and Aria Operations for Logs.
Validate the syslog forwarding configuration applied to the NSX Edge nodes to ensure it is targeting the correct Aria Operations for Logs FQDN or IP address.
Validate logging configuration and verify end-to-end configuration between products
1. In Aria Operations for Logs:
  1. Ensure the latest NSX Content Pack is installed. See Install a Content Pack from the Content Pack Marketplace
  2. Add VMware Cloud Director to Aria Operations for Logs. See Configure a Log Provider in VMware Cloud Director
  3. Confirm that NSX-T logs are actively arriving in the Aria Operations for Logs "Interactive Analytics" view
  4. Confirm if the syslog connection for vCenter and ESXi hosts has been completed as part of adding them to Aria Operations for Logs. See Connect VMware Aria Operations for Logs to a vSphere Environment
  5. Check if the distributed firewall rule, gateway, or rule ID is traceable in Aria Operations for Logs from the cluster ESXi hosts
2. In NSX:
  1. Verify that Aria Operations for Logs is added as a syslog server in the NSX-T Node Profile, configured with the correct port and log level. See Add Syslog Servers for NSX Nodes
  2. Confirm Route Advertisement is properly set on the edge in NSX-T (as required)
3. In Cloud Director:
  1. Check if logs are visible by a system administrator in Cloud Director via the UI or API. Example API call:
    
    GET https://{vcdfdqn}/cloudapi/2.0.0/edgeGateways/urn:vcloud:gateway:{gateway-id}/firewall/logs?page=1&pageSize=10&filterEncoded=true&filter=timestamp=gt=2025-10-29T09:14:22.638Z;timestamp=lt=2025-10-29T09:44:22.638Z&links=true
  2. Ensure the user has the required rights: "Distributed Firewall" and "VDC Group Logging" enabled and published in VMware Cloud Director. See Activate the Distributed Firewall on a VMware Cloud Director
  3. Organization Virtual Data Center
  4. Configure connectivity from Cloud Director to Aria Operations for Logs in the VCD Provider portal. If the VCD UI configuration fails, test API connectivity directly from the Cloud Director cells using:
    
    curl -k -X POST https://<Aria_Operations_for_logs_FQDN>:9543/api/v2/sessions -d '{"username":"admin", "password":"<admin_password>", "provider":"Local"}'