Syslog configuration on secure port 6514 fails to forward logs in VMware NSX

Products

• VMware NSX

Issue/Introduction

NSX Manager fails to forward syslogs to Aria Operations for Logs (Log Management) after changing the destination port from 514 to 6514.

Environment

VMware NSX 4.2.x

Cause

The issue occurs because port 6514 requires the TLS protocol for secure transmission. If the protocol is not explicitly changed to tls or li-tls during configuration, NSX defaults to unsecure TCP, which is rejected by the secure collector. Additionally, secure logging requires CA-signed certificates and the use of FQDNs.

Resolution

This is a configuration requirement. Follow these steps to correctly configure secure syslog:

1. Log in to the NSX Manager CLI.
2. Delete the existing incorrect logging server configuration
   del logging-server <Syslog_Server_FQDN_or_IP>
   
   
3. Verify the required CA-signed certificate is present in the NSX file store.
4. Re-configure the logging server using the li-tls protocol and FQDN: 
   set logging-server <VRLI_FQDN> proto li-tls level info messageid SWITCHING,ROUTING,FABRIC,SYSTEM,POLICY,HEALTHCHECK,SHA,MONITORING serverca <cert>
   
   
5. Verify the configuration: 
   get logging-servers
   
   
6. Confirm logs are arriving at the destination collector.

Additional Information

For more details on Li-TLS parameters, see VMware NSX Documentation - Configure Remote Logging.