NSX Operations, Monitoring, and Troubleshooting
Observability and troubleshooting
Operations use alarms, health checks, dashboards, metrics, logs, and flows. Start with scope: is the problem management (API/UI), control (topology, routes, DFW policy), or data (packets)? Verify transport node status, tunnel status, TEP reachability, and MTU. Traceflow injects a synthetic packet and shows observation points, helping locate the drop or forwarding stage; packet capture shows actual traffic; port mirroring copies traffic to an analyzer; IPFIX exports flow records. Use CLI and support bundles for deep evidence, and syslog for centralized logs.
Traps: using Traceflow as proof of application behavior; ignoring asymmetric routing; forgetting that dropped packets may be blocked by DFW, not routing; checking only Manager health and not data-plane tunnels.
Rule of thumb: synthetic first to locate, capture second to confirm. Worked example: a VM cannot reach a remote subnet. Traceflow shows the packet reaching the Tier-1 distributed router but no forwarding to the Tier-0 uplink; check Tier-1 to Tier-0 attachment, route advertisement, and Edge cluster health before changing firewall rules.