NSX Guest Introspection Platform Host Agent (MUX) Logs

If virtual machines on an ESXi host are not working with NSX Malware Prevention, NSX Endpoint Protection, IDFW or NSX Intelligence or if there are alarms on a host regarding communication to the SVA, then NSX Guest Introspection Platform on the ESXi host might face some issues.

Log Path and Sample Message

MUX Log path
/var/log/syslog

NSX Guest Introspection Platform host agent (MUX) messages follow the format of <timestamp>ContextMUX<[ThreadID]>: <message>

For example:

2022-08-25T11:42:02Z ContextMux[54425342]: [INFO] (EPSEC) [54425342] NSX Context Multiplexor 17883598. [3.1.2.0.0]
2022-08-25T11:42:02Z ContextMux[54425342]: [INFO] (EPSEC) [54425342] VMkernel localhost 6.7.0 #1 SMP Release build-13006603 Mar 26 2019 13:38:24 x86_64
2022-08-25T11:42:02Z ContextMux[54425342]: [WARNING] (EPSEC) [54425345] Not sending events. MuxHandler has not been registered.

In the above example

• [ERROR] is the type of message. Other types can be [DEBUG], [INFO]
• (EPSEC) represents that the messages are specific to Endpoint Security

Enabling and Viewing Log Files

To view the version of the NSX Guest Introspection Platform host agent (MUX) VIB installed on the host, run the #esxcli software vib list | grep nsx-context-mux command.

To turn on full logging, perform these steps on the ESXi host command shell:

1. Set the NSX Guest Introspection Platform host agent (MUX) logging level.

   ~ # nsxcli

   localhost> set service nsx-context-mux logging-level debug

   off - The highest possible rank and is intended to turn off logging

   fatal - Designates very severe events that may cause application to abort

   error - Designates error events that may allow application to continue running

   warn - Designates potentially harmful situations

   info - Designates coarse-grained informational messages

   debug - Designates fine-grained informational messages for debugging purposes

   trace - Designates finer-grained informational events than debug

2. View the NSX Guest Introspection Platform host agent (MUX) log messages in the /var/log/syslog.log file on the ESXi host. Check that the entries corresponding to the global solutions, solution ID, and port number are specified correctly.

For more details, refer to NSX Guest Introspection Platform Host Agent (MUX) Logs.

Sample muxconfig.xml File

<?xml version="1.0" encoding="UTF-8"?>
<EndpointConfig>
 <hostMoid>702e86b6-09ad-4dc7-9473-fbe2ba01f7f7</hostMoid>
 <InstalledSolutions>
  <Solution>
   <id>100</id>
   <listenOn>unixdom</listenOn>
   <port>48656</port>
   <uuid/>
   <vmxPath/>
  </Solution>
  <Solution>
   <id>7498352642083520512</id>
   <ipAddress>xxx.xxx.x.xx</ipAddress>
   <listenOn>ip</listenOn>
   <port>48651</port>
   <uuid/>
   <vmxPath/>
  </Solution>
 </InstalledSolutions>
 <DefaultSolutions/>
 <GlobalSolutions>
  <solution>
   <id>100</id>
   <tag/>
   <order>0</order>
  </solution>
 </GlobalSolutions>
 <VmConfig>
  <uuid>50259775-1c32-a940-de62-ed537ba0d0bf</uuid>
  <solution>
   <id>7498352642083520512</id>
   <tag>Gold</tag>
   <order>7498352642083520512</order>
   <action/>
   <file_types/>
  </solution>
 </VmConfig>
</EndpointConfig>