Forwarding Syslog from VMware ESXi 6.x to a Syslog Server

The logs of a VMware ESXi host are not all that important, but out of curiosity I configured forwarding to a syslog server, and these are my notes

Configuration steps

This forwarding setup is meant for those who already have a syslog server prepared and can log in to VMware ESXi as root

Configuring the syslog host

1. Log in as an administrator in the VMware web interface
2. Click Manage in the left column of the dashboard
3. On the System tab in the right column, click Advanced settings
4. Type syslog into the search box and apply the filter
5. Select “Syslog.global.logHost” and click “Edit option”
6. Specify the forwarding method and the syslog server to forward to as the new value, and save it

 "udp://192.168.1.1:514"

 For multiple entries,
 "udp://192.168.1.1:514,tcp://192.168.1.2:1514"

7. Click Refresh

Up to this point you have only saved the setting, and forwarding is still disabled

Enabling log forwarding

To allow syslog forwarding you have to configure the VMware firewall, so enable it

1. Log in as an administrator in the VMware web interface
2. Click Networking at the bottom of the left column
3. Select the Firewall rules tab in the right column
4. Click the one named Syslog (it is easier if you type syslog into the search box)
5. Click Actions and choose Enable

That completes the minimum log forwarding configuration.
What follows is only for those who are interested.

Checking the log details

I logged in to the VMware ESXi host over SSH and had a look at the log related settings

# esxcli system syslog config get
   Default Network Retry Timeout: 180
   Dropped Log File Rotation Size: 100
   Dropped Log File Rotations: 10
   Enforce SSLCertificates: true
   Local Log Output: /scratch/log
   Local Log Output Is Configured: false
   Local Log Output Is Persistent: true
   Local Logging Default Rotation Size: 1024
   Local Logging Default Rotations: 8
   Log To Unique Subdirectory: false
   Message Queue Drop Mark: 90
   Remote Host: udp://192.168.1.1:514

Fixing the syslog level

Once you start collecting logs, a huge number of verbose logs get recorded, so change it if it bothers you

Rhttpproxy: verbose rhttpproxy …..

1. Log in to the VMware ESXi host over SSH
2. Edit /etc/vmware/rhttpproxy/config.xml (around line 32)

...
@@ -30,7 +30,7 @@
     <maxFileNum>8</maxFileNum>

     <!-- default log level -->
-      <level>verbose</level>
+      <level>warning</level>

3. Once you save it, it takes effect without restarting syslog (probably?)

Besides Rhttpproxy, vpxa and hostd also produce verbose output, so it is a good idea to edit them in the same way

By the way, going by the definition inside hostd’s config.xml, the facility seems to be local4.

If you want to change the facility, it appears that just rewriting local4 is not enough, so see Configuring syslog logging for hostd and vpxa management agents on ESXi/ESX (1017658)

Reference articles

• チュートリアル - VMware ESXi Syslogの設定| ステップバイステップ (in Japanese)
• VMware ESXi 6.5U1のsyslogで記録するlevelを修正する | Highspec Diary (in Japanese)
• VMware vCenter Server と VMware ESX/ESXi のログ レベルを上げる方法 (1004795) (in Japanese)

See also