Playbook
Home / Logging & Syslog / Install

Run the syslog server as a VMware VM (Workstation or ESXi)

safe intermediate #vmware#vm#ubuntu#bridged#netplan#static ip

When to use this: You have VMware (Workstation, Fusion or ESXi) and want a dedicated, snapshot-friendly syslog VM on the LAN.

Before you start

Steps

  1. Create the VM with modest resources

    Guest OS Ubuntu 64-bit. For rsyslog: 1 to 2 vCPU, 2 GB RAM, 40 GB or more disk (size it for retention). For Graylog or Wazuh use more RAM and CPU, per the product's requirements. Thin-provisioned disk is fine for a lab; use thick or a separate data disk in production.

  2. Attach the network so the firewall can reach it

    Workstation/Fusion: choose Bridged so the VM gets an address on your LAN (NAT would hide it from the firewall). ESXi: connect the VM to the port group or VLAN that the firewall's management or log interface can route to.

  3. Install Ubuntu Server and open-vm-tools

    terminal
    sudo apt update
sudo apt install -y open-vm-tools

    Gives clean shutdowns, time sync with the host (if configured) and better integration.

  4. Give it a static IP with netplan

    terminal
    sudo nano /etc/netplan/50-cloud-init.yaml

    Example content (adjust the interface name, shown with ip a, often ens33 or ens160): set dhcp4: false, addresses: [192.168.1.10/24], a default route via your gateway and DNS servers. Keep the YAML spacing exact.

    Use sudo netplan try to test: it rolls back automatically if you lose connectivity.

  5. Apply and verify

    terminal
    sudo netplan try
ip -4 a

    Press Enter to accept the change when asked. Confirm the address.

  6. Install the syslog software and take a snapshot

    Follow the Ubuntu rsyslog scenario. When it works, take a VM snapshot named 'clean syslog working' so you can roll back after experiments.

How to verify it worked

  • The VM keeps its IP after reboot, and the firewall can ping it.
  • Logs from the real device appear in the VM.

How to undo it

Revert to the snapshot, or delete the VM and its disk to remove everything.

Common errors and fixes

Firewall cannot reach the VM on Workstation The adapter is on NAT or host-only. Switch to Bridged and select the correct physical adapter (VMware Workstation, Virtual Network Editor).
VM clock drifts, logs have odd times Enable NTP in the guest (timedatectl, chrony) rather than relying only on host sync.
Disk fills quickly Add a second virtual disk for /var/log/remote, and apply retention (see the sizing scenario).

Q&A

Bridged or NAT networking?

Bridged, so the VM is a normal device on your LAN. NAT puts it behind the host and other devices cannot reach it without port forwarding.

Should I snapshot a log server?

Snapshots are good before changes. Do not keep them for long on a busy VM: they grow and slow the VM. Back up the log data itself separately.

Practice these as flashcards →

Terms in this scenario

Syslog server

Related scenarios

My notes

Saved in this browser only.