diff --git a/vmware_nsx/plugins/nsx_v/vshield/vcns.py b/vmware_nsx/plugins/nsx_v/vshield/vcns.py
index 480bc00e2f..98872b84f1 100644
--- a/vmware_nsx/plugins/nsx_v/vshield/vcns.py
+++ b/vmware_nsx/plugins/nsx_v/vshield/vcns.py
@@ -12,6 +12,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import re
 import time
 
 from oslo_config import cfg
@@ -122,16 +123,27 @@ class Vcns(object):
                                                          insecure=insecure)
         self._nsx_version = None
 
+    def _log_request(self, method, uri, body, format):
+        if format == 'json':
+            pattern = r'\"password\": [^,}]*'
+            body = re.sub(pattern,
+                          '"password": "********"', body)
+        else:
+            pattern = r'<password>.*?</password>'
+            body = re.sub(pattern,
+                          '<password>********</password>', body)
+        LOG.debug("VcnsApiHelper('%(method)s', '%(uri)s', '%(body)s')", {
+                  'method': method,
+                  'uri': uri,
+                  'body': body})
+
     @retry_upon_exception(exceptions.ServiceConflict)
     def _client_request(self, client, method, uri,
                         params, headers, encodeParams):
         return client(method, uri, params, headers, encodeParams)
 
     def do_request(self, method, uri, params=None, format='json', **kwargs):
-        LOG.debug("VcnsApiHelper('%(method)s', '%(uri)s', '%(body)s')", {
-                  'method': method,
-                  'uri': uri,
-                  'body': jsonutils.dumps(params)})
+        self._log_request(method, uri, jsonutils.dumps(params), format)
         headers = kwargs.get('headers')
         encodeParams = kwargs.get('encode', True)
         if format == 'json':