Symptoms
- Syslog service on edge shows as running.
- Syslog is configured for UDP.
- NSX version is 6.4.3.
- You can see the log on Edge:
>syslog-ng[862]: [xx]: [syslog.err] I/O error occurred while writing; fd='42', error='Message too long (90)'
Cause
Previous syslog version had a default message size of 8k. Later versions have the default set to 65536. This default setting is too large for UDP log destinations, and our syslog-ng config file does not explicitly specify the message size.
Impact / Risks
Syslog service stops sending messages.
Resolution
Issue is resolved on NSX 6.4.4
Workaround
Use TCP on syslog configuration.
To work around this issue if you do not want to upgrade or use TCP, contact VMware Support and file a Support Request. For more information, see Filing a Support Request in Customer Connect (2006985) or How to Submit a Support Request.
