Faster Log Insight Responses for NSX Firewall Source/Destination IP Queries
We've been doing a lot of work with the NSX Firewall recently. Log Insight has become our go-to tool for troubleshooting to get real-time information about what the firewall is doing. By far, the most common query that I run in Log Insight will be for all entries that have a vmw_nsx_firewall_src or vmw_nsx_firewall_dst of the IP Address that I'm interested in, and I'll often throw a vmw_nsx_firewall_dst_port or a vmw_nsx_firewall_action into the mix to further refine my results. Unfortunately, these queries can be pretty slow. They're great if you're looking at the last 5 minutes worth of data, and they're pretty good going back to the past hour... but when we went beyond a 1 hour window, we found ourselves needing to wait. If we wanted to go all the way out to a 24 hour window, we'd need to go get lunch while the query ran. That seemed unreasonable to us, so we opened a support ticket and the VMware engineer made some tweaks that absolutely hel...