ESXi host logs not visible in VCF Operations for Logs through firewall

Products

• VCF Operations

Issue/Introduction

You are using VCF Operations for Logs for the log management of all the hosts.

You are using unified Cloud Proxy for the purpose of syslog forwarding from those hosts to VCF Operations for Logs.

You have hosts behind the firewalls, and you cannot see logs from these hosts in VCF Operations for Logs.

You find port 9543 is not open from Cloud Proxy to VCF Operations for Logs cluster nodes, and port 514 is not open from the ESXi hosts to Cloud Proxy.

 

Environment

Aria Operations for Logs 8.18.x

VCF Operations for Logs 9.0.2

Cause

Required firewall rules are not in place.

Aria Operations 8.18 introduced the ability to use Cloud Proxies (CPs) for log forwarding. See Deploy a Cloud Proxy for VMware Aria Operations for Logs. It requires specific egress ports (9543) for the log ingestion API over SSL, which may differ from standalone proxy requirements in older versions. See VMware Ports and Protocols.

Resolution

1. Make sure the ports required in Configuring Cloud Proxies in VCF Operations are configured properly.

2. If you are using the unified Cloud Proxy for log forwarding, make sure port 9543 is opened from the Cloud Proxy to VCF Operations for Logs cluster nodes. See details in VMware Ports and Protocols. SSH into the Cloud Proxy appliance and run the following command to verify egress connectivity to the Log nodes.

   curl -v telnet://[VCF_Ops_Logs_IP]:9543

3. Port 514 needs to be opened from the hosts to Cloud Proxy for the purpose of outbound syslog traffic. SSH into Cloud Proxy appliance as root user and run the following command to confirm if syslog packets reach the interface:

   tcpdump -i eth0 port 514

   or SSH into the ESXi hosts as root user and run the following command to verify if the connection on port 514 is open:

   curl -vk telnet://[unified_CloudProxy_IP]:514