Log messages from all NSX-T components except the ones running on ESXi conform to the RFC 5424 format. You can configure a remote logging server to receive log messages.

For more information about RFC 5424, see https://tools.ietf.org/html/rfc5424.

RFC 5424 defines the following format for log messages:

<facility * 8 + severity> version UTC-TZ hostname APP-NAME procid MSGID [structured-data] msg

A sample log message from NSX Manager:

<187>1 2016-03-15T22:53:00.114Z nsx-manager NSX - SYSTEM [nsx@6876 comp="nsx-manager" errorCode="MP4039" subcomp="manager"] Connection verification failed for broker ''. Marking broker unhealthy.

NSX-T produces regular logs (facility local6, which has a numerical value of 22) and audit logs (facility local7, which has a numerical value of 23). All API calls trigger an audit log.

RFC 5424 defines the following severity levels:

Severity Value



Emergency: system is unusable


Alert: action must be taken immediately


Critical: critical conditions


Error: error conditions


Warning: warning conditions


Notice: normal but significant condition


Informational: informational messages


Debug: debug-level messages

All logs with a severity of emergency, alert, critical, or error contain a unique error code in the structured data portion of the log message. The error code consists of a string and a decimal number. The string represents a specific module.

The MSGID field indicates a category for the log message. For a list of the categories, see Log Message Categories.