Quantcast
Channel: VMware Communities: Message List
Viewing all articles
Browse latest Browse all 252940

Re: Remote Syslog on ESXi 5.1.0

$
0
0

I realize this thread is very old but I came across it while troubleshooting the same problem under ESXi 5.1 not getting syslog data to our remote syslog server and thought I'd provide feedback on my experience.

 

First issue in my case was simply that syslog was not enabled within the ESXi firewall for outgoing TCP/UDP connections on 514.

 

Next, my initial setting for Syslog.global.logHost was tcp://<ip>:514.  VMware's KB on troubleshooting syslog indicates in the "Notes" section that only UDP is supported:

http://kb.vmware.com/kb/2003127

 

Based on that I changed Syslog.global.logHost to udp://<ip>:514 and then reloaded the configuration:

 

esxcli system syslog reload

 

Testing connection to our syslog server from the ESXi host was successful:

 

 

~ # nc -zu <ip> 514
Connection to <ip> port [udp/syslog] succeeded!

 

When we checked our syslogd server at this point, syslog traffic was working and WireShark was also confirming UDP packet transmission from ESXi.  I believe TCP would also work fine and most likely the issue for us was just the firewall port.

 

One additional thing I observed is that whenever I run the reload command, the error log (/var/log/.vmsyslogd.err) shows the following, which seems to be benign...

 

vmsyslog.main: ERROR   ] reloading (<first pid seen when you run "ps | grep syslog">)


Viewing all articles
Browse latest Browse all 252940

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>