Syslog Exporter Configuration Cleared After Using Node Profile (Central Node Config) in NSX

Products

• VMware NSX

Issue/Introduction

• The local syslog configuration on NSX Manager or Edge nodes disappears unexpectedly. This typically occurs after you use Node Profile (Central Node Config) to configure other settings, such as NTP or SNMP, through the NSX UI.
• The syslog exporter configuration disappears from NSX Manager or Edge nodes.
• In /var/log/syslog, you see an INFO message similar to:

  NSX 2XXXX2 - [nsx@XXXX comp="nsx-manager" subcomp="central_node_config_update" username="root" level="INFO"] Updating Syslog configuration"

• The CLI syslog configuration is removed or overwritten.
• The issue occurs shortly after you change Node Profile settings via the NSX UI.
• The Central Config API shows the syslog exporter list as empty ([]).
• Example API call:
  GET /api/v1/configs/central-config/node-config-profiles/00000000-0000-0000-0000-000000000001
  • The returned JSON contains no syslog exporter:

{
    "syslog": {
        "exporters": []
    }
}

Environment

NSX 4.x
VCF 9.X

Cause

This behavior occurs because the Node Profile UI writes an empty list ([]) for the syslog exporter field in Central Config, which NSX then interprets as a request to remove syslog configuration from all nodes.

Resolution

There are two recommended approaches:

Option 1: Remove syslog field from Central Config and configure syslog locally

1. Retrieve the current Node Profile payload:

   GET /api/v1/configs/central-config/node-config-profiles/00000000-0000-0000-0000-000000000001

2. Remove the entire "syslog" field from the JSON.

   Example cleaned payload:

   {
     "ntp": { ...unchanged... },
     "snmp": { ...unchanged... },
     "resource_type": "CentralNodeConfigProfile",
     "id": "00000000-0000-0000-0000-000000000001",
     "display_name": "All NSX Nodes",
     "description": "All configurations in this profile are applied to Manager and Edge nodes.",
     "_create_time": <Keep same as is get call>,
     "_last_modified_user": "<Keep same as is get call>",
     "_last_modified_time": <Keep same as is get call>,
     "_create_user": "system",
     "_system_owned": false,
     "_protection": "NOT_PROTECTED",
     "_revision": 5
   }

3. Push the cleaned payload:

   PUT /api/v1/configs/central-config/node-config-profiles/00000000-0000-0000-000000000001

4. Reconfigure syslog locally on each node via CLI.

It will no longer be overwritten by Central Config.

Option 2: Manage syslog centrally using Node Profile

If customers prefer central management:

• Reconfigure the syslog exporter directly in Node Profile (Central Node Config).

• All nodes will inherit syslog configuration from the profile.