Quick post documenting some useful CLI commands for troubleshooting NSX, mainly for my own reference. Other useful information can be found at NSX CLI Cheat Sheet and NSX for vSphere Command Line Interface Reference.
Open an SSH session to an ESXi host. The SSH service can be started from the Configure, System, Security Profile page in the vSphere web client, or under Manage, Services when logging into the host UI.
esxcli software vib listdisplays installed vibs, add
| grep esxto filter.
vmkload_mod -l | grep vddisplays the loaded drivers, add
| grep nsxto filter, nsx-vdl2, nsx-vdrb, and nsx-vsip kernel modules should be loaded (
/etc/init.d/vShield-Stateful-Firewall statusdisplays the status of user world agent vsfwd which connects the host to NSX Manager.
/etc/init.d/netcpad statusdisplays the status of user world agent netcpa which connects the host to the controller cluster.
tail -f /var/log/netcpa.logtails the user world agent netcpa log.
- Note – to change the logging level for netcpa execute the following commands on the ESXi host:
chmod +wt /usr/lib/vmware/netcpa/etc/netcpa.xmlgives write permissions to the file.
vi /usr/lib/vmware/netcpa/etc/netcpa.xmlopens the file in an editor. Find <level>info</level>, press insert to edit the line and replace info with verbose. Press escape twice and enter :wq to save the file and quit.
/etc/init.d/netcpad restartrestarts netcpad.
esxcfg-advcfg -g /UserVars/RmqIpAddresslists the IP address of the registered NSX Manager.
esxcli network ip connection listlists active TCP/IP connections, add
| grep 5671to filter port 5671 used to connect to NSX Manager.
ping ++netstack=vxlan -d -s 1572 -I vmk3 <VMK> <VTEP>can be used to ping a VTEP IP address using an increased packet size, where
<VMK>is the VMkernel to use on the source host, and
<VTEP>is the destination VTEP IP address to ping.
- For example
ping ++netstack=vxlan -d -s 1572 -I vmk4 192.168.30.12
- If the ping comes back successful then we know the MTU is set correctly, since the command specifies a packet size of 1572 (there is a 28 byte overhead = 1600). If the ping drops the packet then try reducing the packet size to 1472:
ping ++netstack=vxlan -d -s 1472 -I(again + 28 byte overhead = 1500). If the smaller ping packet is successful but the larger packet is dropped then we know there is an MTU mismatch.
- For example
pktcap-uwcan be used for packet capturing, full syntax here.
esxtopis a useful host troubleshooting tool, type
nto switch to network view.
NSX Manager Appliance
Open an SSH session to the NSX Manager. The SSH service can be started from the Summary page of the NSX Manager Virtual Appliance Management page.
show interfacedisplays information for the NSX Manager management interface.
show ip routeNSX Manager route information.
show filesystemNSX Manager file system capacity.
show log manager followfollows the NSX Manager log.
show controller list alldisplays the controller nodes status.
show cluster alldisplays vSphere clusters managed by the vCenter Server.
show logical-switch list alldisplays all logical switch information.
show logical-switch controller master vni 5001 connectiondisplays the hosts connected to segment ID 5001, also replace connection with
show logical-router list alldisplays all distributed logical router information.