Playbook
Home / Logging & Syslog / Connect sources

Send VMware ESXi logs to a syslog server

safe intermediate #esxi#vmware#esxcli#loghost#vsphere

When to use this: You want ESXi host logs stored centrally instead of on the host's small local log area.

Before you start

Steps

  1. See the current settings

    terminal
    esxcli system syslog config get

    Shows the current Remote Host and local log settings.

  2. Set the remote log host

    terminal
    esxcli system syslog config set --loghost='udp://192.168.1.10:514'
esxcli system syslog reload

    Use tcp:// instead of udp:// for reliable delivery, or ssl:// for TLS where supported. Reload applies the change.

  3. Open the ESXi firewall for syslog

    terminal
    esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network firewall refresh

    Required even for the standard ports: the syslog ruleset is not always enabled by default.

  4. Send a test message

    terminal
    esxcli system syslog mark --message="Syslog test from ESXi"

    Writes a marker line that should arrive at the server.

  5. Check reachability (optional)

    terminal
    nc -z 192.168.1.10 514

    Tests the TCP port from the host. UDP cannot be proven this way, so also check on the server.

Commands follow the Broadcom/VMware knowledge-base article “Configuring syslog on ESXi”. Check it for your ESXi version.

How to verify it worked

  • The test marker appears in /var/log/remote/<esxi-ip>/<today>.log on the server.

How to undo it

Remove the remote host:

terminal
esxcli system syslog config set --reset=loghost
esxcli system syslog reload

Common errors and fixes

Nothing arrives Enable the syslog firewall ruleset (step 3), check the server firewall and the loghost format, and watch with tcpdump on the server.
Logs stop after the server was down for a while Some TCP setups do not reconnect reliably. Restart the syslog service on the host (esxcli system syslog reload) and consider UDP or a stable server.
Several hosts look the same in the folders Each host's IP creates a folder. Label hosts in your documentation, or set unique names on the hosts.

Q&A

Which command sets the remote syslog target on ESXi?

esxcli system syslog config set --loghost='tcp://<ip>:514', then esxcli system syslog reload.

Why do I need to open the firewall on ESXi?

ESXi has its own firewall, and the syslog ruleset must be enabled for outgoing syslog even on standard ports.

Practice these as flashcards →

Terms in this scenario

Syslog server

Related scenarios

My notes

Saved in this browser only.