Configuring a VMware NSX-T Device to Send Syslogs

This topic is intended for TOS Administrators.

Overview

Configure the NSX Manager to send change logs to SecureTrack to receive revisions when firewall rules are changed.

Syslog traffic must be configured to arrive to the TOS cluster that monitors the device - see Sending Additional Information via Syslog.

Define SecureTrack as a Syslog Server

1. Login to the NSX Manager CLI

2. Run the command:

   set logging-server <host>:514 proto udp level info messageid <messageid> [structured-data update="true"]

   where

   <host> is the host name or IP address

   <messageid> is "FIREWALL" for imperative APIs or the dash character "-" for declarative APIs

   (Optional) structured-data parameter is recommended for in-depth filtering

For more information, see official VMware documentation: Configure Remote Logging and Log Message IDs.