8.4 Nutanix Support Ecosystem: Diagnostics, Log Gathering, and Support Bundles

Nutanix Support Ecosystem: Diagnostics, Log Gathering, and Support Bundles

Quick Summary: Troubleshooting enterprise hyperconverged clusters requires rapid, precise log collection and collaboration with technical support. Nutanix provides the parallelized logbay CLI utility and Prism Element Log Collector to gather scoped, anonymized diagnostic bundles filtered by time and service tags. The support ecosystem is further empowered by Nutanix Pulse and Insights cloud-based predictive telemetry, administrator-controlled outbound reverse SSH Remote Support tunnels, and authoritative documentation via the Nutanix Support Portal and Nutanix Bible.

---

1. Diagnostic Log Gathering: Logbay CLI vs. Prism Element GUI

In a distributed architecture where storage, virtualization, and management services execute concurrently across dozens of nodes, gathering diagnostic logs manually across individual servers is impractical. A single cluster can generate dozens of gigabytes of log telemetry daily across operating system kernels, hypervisor daemons, and storage controller services.

To solve this challenge, Nutanix replaced legacy log collection scripts with Logbay—a high-performance, modular diagnostic framework designed for speed, low resource consumption, and granular scoping.

+-------------------------------------------------------------------------+
|                   Nutanix Diagnostic Log Collection                     |
+-------------------------------------------------------------------------+
|  [ Prism Element GUI Log Collector ]    |  [ Logbay Command-Line (CLI) ]|
|  - Web-based wizard in Settings         |  - Command: logbay collect    |
|  - Select time window (e.g. past 4 hrs) |  - Granular service tag filter|
|  - Auto-upload to Nutanix Support Case  |  - Parallel multi-node worker |
+--------------------+--------------------+-------------------------------+
                     |                    |
                     +----------+---------+
                                |
                                v
+-------------------------------------------------------------------------+
|  [ Logbay Staging Directory: /home/nutanix/data/logbay/bundles/ ]       |
|  - Parallel gzip compression per node                                   |
|  - Throttled CPU & memory footprint (protects Stargate storage I/O)    |
|  - Optional cryptographic anonymization (--anonymize=true)              |
+-------------------------------------------------------------------------+

Core Advantages of Logbay over Legacy Tools

• Distributed Parallel Collection: Logbay dispatches worker processes to all CVMs simultaneously, compressing and packaging logs locally on each node rather than serializing data over the network to a single node.
• Throttled Resource Consumption: Logbay operates within strict CPU and memory boundaries. It prioritizes guest virtual machine I/O and Stargate daemons, ensuring that log collection never introduces latency spikes to production applications.
• Bundle Staging: Generated bundles are stored on each CVM under /home/nutanix/data/logbay/bundles/, allowing direct retrieval via SCP, SFTP, or automated upload to Nutanix Worldwide Support.

Prism Element Graphical Log Collector

For administrators who prefer web workflows, Prism Element provides a streamlined interface:

1. Log into Prism Element and click the gear icon (Settings).
2. Under the Troubleshooting section, select Log Collector.
3. Click Collect Logs to open the configuration dialog:
   • Support Case Number: Enter the 8-digit Nutanix Support case number to automatically associate the bundle with an open ticket.
   • Time Period: Choose a predefined window (Past 2 hours, 4 hours, 12 hours, 24 hours) or define a custom historical range.
   • Target Categories: Check or uncheck functional areas (AOS services, Hypervisor logs, Hardware/BMC logs, System logs).
   • Upload Automatically: When checked, the cluster uploads the bundle directly to Nutanix Support upon collection.

---

2. Logbay CLI Syntax, Time Scoping, and Tag Filters

Executing logbay via the CVM command line provides systems engineers with unparalleled precision. By tightly scoping timeframes and service components, administrators can produce compact diagnostic bundles (under 500 MB) in minutes rather than waiting hours for sprawling, multi-gigabyte archives.

Basic Command Syntax and Time Scoping

To initiate log collection from any CVM terminal, connect via SSH as user nutanix and utilize the collect command:

# Collect logs for a specific 4-hour window from a designated start time
logbay collect --from="2026/09/05-10:00:00" --duration=+4h

# Collect logs between two exact timestamps
logbay collect --from="2026/09/05-08:00:00" --to="2026/09/05-12:30:00"

# Direct automated upload to an active Nutanix Support case
logbay collect --case-number=12345678 --upload

Filtering by Service Tags

Logbay organizes logs into logical tags corresponding to specific subsystems. Administrators can combine multiple tags using comma-separated arguments:

# Collect only storage controller and metadata logs for the past 2 hours
logbay collect --tags=stargate,curator,cassandra --duration=-2h

# Collect hypervisor and virtual networking logs
logbay collect --tags=hypervisor,network --duration=-4h

[!TIP] To inspect all available tags supported by the running cluster version, execute logbay list in the CVM shell. This displays all tag definitions and their mapped directory paths.

---

3. Data Sanitization and Cryptographic Anonymization

In heavily regulated environments—such as healthcare (HIPAA), financial services (PCI-DSS, GLBA), and government institutions—exporting diagnostic logs containing internal network topology, server hostnames, or user accounts creates significant security compliance risks.

Logbay resolves this by incorporating a built-in cryptographic anonymization engine:

# Generate a sanitized support bundle with anonymized identifiers
logbay collect --anonymize=true --duration=-4h

How Anonymization Works

When --anonymize=true is invoked, Logbay parses log files prior to compression and executes consistent, deterministic masking:

• IP & MAC Addresses: Replaced with synthetic cryptographic hashes (e.g., 10.10.20.15 becomes ANON_IP_8a4f91). Importantly, the mapping is consistent across all files in the bundle, allowing support engineers to correlate network conversations between two nodes without knowing their real corporate IP addresses.
• Virtual Machine Names: Obfuscated into generic entity identifiers (e.g., SQL-Prod-Database01 becomes ANON_VM_0042).
• Storage Containers & Volume Groups: Renamed to generic container tokens.
• User Accounts & Domain Credentials: All administrative usernames, Active Directory domain paths, and security tokens are stripped completely.

---

4. Nutanix Pulse and Insights Cloud-Based Proactive Analytics

Modern enterprise support requires shifting from reactive break-fix firefighting to automated predictive remediation. Nutanix Pulse and Nutanix Insights represent the twin pillars of this proactive strategy.

+-----------------------+           +-----------------------------------+
| On-Premises Cluster   |           | Nutanix Cloud Intelligence        |
|                       |           |                                   |
|  [ Nutanix Pulse ]    |  HTTPS    |  [ Nutanix Insights Engine ]      |
|  • System Health Data | (Port 443)|  • Machine Learning Diagnostics   |
|  • NCC Test Results   | ========> |  • Known Defect Pattern Matching  |
|  • Disk Error Rates   | (No Data) |  • Smart Support Auto-Case Creation|
+-----------------------+           +-----------------+-----------------+
                                                      |                 
                                                      v                 
                                    +-----------------------------------+
                                    | [ Automated Replacement Dispatch ]|
                                    | Nutanix Support ships replacement |
                                    | SSD before the drive fails!       |
                                    +-----------------------------------+

Nutanix Pulse Telemetry Mechanics

• Embedded Service: Pulse is the telemetry transport engine embedded within AOS, enabled by default.
• Outbound Secure Transport: Telemetry is transmitted over secure HTTPS (TCP port 443) to Nutanix cloud endpoints. It requires no inbound firewall ports.
• Zero Customer Data Transmission: Pulse collects only system health metrics, hardware serial numbers, hypervisor versions, storage utilization rates, and NCC execution summaries. It never accesses guest virtual machine contents, application databases, or customer files.

Nutanix Insights & Smart Support

The telemetry received by Pulse is continuously processed by the Nutanix Insights platform:

• Heuristic Pattern Matching: Compares incoming telemetry against hundreds of thousands of known bug signatures, historical failure trends, and hardware advisories.
• Predictive Hardware Failure (Smart Support): If an SSD begins exhibiting excessive raw read errors, flash cell wear, or reallocated sector spikes, Insights detects the trend long before the drive completely fails. Insights automatically generates a Nutanix Support case, alerts the administrator via email, and initiates the automated dispatch of a replacement drive to the customer's datacenter.
• Actionable Guidance: Recommends proactive software updates or configuration modifications in Prism Central before latent bugs can impact operations.

---

5. Remote Support Tunnel Architecture and Operational Security

When complex operational incidents occur, Nutanix Worldwide Support engineers may require direct terminal access to investigate CVM daemons. Traditional remote access models—such as requiring customers to open inbound SSH firewall ports or configure temporary VPN accounts—introduce severe security vulnerabilities.

Nutanix solves this with the Remote Support Tunnel—an administrator-controlled, outbound-only reverse SSH architecture.

+---------------------------------------+           +-------------------+
| Customer Datacenter (Secure Firewall) |           | Nutanix Support   |
|                                       |           | Operations Center |
|  [ Controller VM (CVM) ]              |           |                   |
|       |                               |           |  [ Assigned       |
|       | Outbound Reverse SSH          |           |    Support Eng ]  |
|       | TCP Port 80 or 8443           |           |         |         |
|       v                               |           |         v         |
|  +---------------------------------+  |           |   (Authenticated  |
|  | Outbound Corporate Firewall /   |  |           |    Access Token)  |
|  | Forward Proxy                   |  |           |         |         |
|  +----------------+----------------+  |           |         |         |
|                   |                   |           |         |         |
+-------------------|-------------------+           +---------|---------+
                    |                                         |          
                    v                                         v          
          +-------------------------------------------------------+      
          |             Nutanix Secure Tunnel Gateway             |      
          |               (tunnel.nutanix.com)                    |      
          +-------------------------------------------------------+      

Security & Operational Controls of the Tunnel

1. Outbound-Only Connection: The tunnel is initiated from within the cluster outward to tunnel.nutanix.com using TCP port 80 or 8443. It encapsulates SSH within standard web ports, allowing traversal through corporate egress firewalls and forward proxies without opening any inbound ports.
2. Administrator Activation Required: The tunnel is disabled by default. It can only be opened when a cluster administrator explicitly navigates to Prism Settings > Remote Support, checks Enable, and clicks Save.
3. Session Token Authorization: The administrator receives a secure, temporary authorization key/token from the Prism UI and supplies it to the assigned support engineer to grant session access.
4. Automatic Expiration Timer: The connection incorporates a configurable auto-close timer (defaulting to 24 hours). When the timer expires, the tunnel immediately tears down.
5. Instant Revocation: Administrators retain full sovereignty; clicking Disable at any moment severs the connection immediately.
6. Comprehensive Auditing: All commands executed by support engineers through the tunnel are captured in the cluster's local audit logs for post-incident review.

---

6. Official Nutanix Documentation & Ecosystem Resources

To maintain high availability and prepare for professional certifications like the Nutanix Certified Associate (NCA), administrators must know where to find authoritative documentation.