NSX DFW logs are part of the ESXi host log and need to be configured on each ESXi host that has NSX DFW installed:
- Log in to the vSphere Web Client UI, navigate to Home | Host & Clusters, and select an ESXi host. In the center pane of the selected ESXi host, select the Configure tab, expand the System section, and select Advanced System Settings. The syslog server settings are specified under the Syslog.global.logHost attribute. For a faster search, use the filter in the upper-right menu.
- To specify an external syslog server, use the Edit button and input the external syslog server with the format <protocol>://<FQDNorIP>:<port>-for example, udp://log-01a.corp.local:514. Repeat the steps for all hosts with NSX ...