Commands for configuring Syslog

Procedure for configuring and Testing Logging

When everything has been installed configured correctly in terms of the Syslog Collector, log files should show up in the Syslog server following the last pieces of config information as per below

• Log into vCenter
• Check on each host that the firewall has been adjusted to allow syslog

• Go to Home > Administration > Network SysLog Collector
• You will see information related to the setup and the log file locations

• Open an SSH session on every host and type the following 2 commands
• Don’t forget to reload the configuration

• You can check if this been set in the hosts Advanced Settings
• Assuming you are sending logs to a Syslog collector named loghost.company.corp, you would enter one of the following in the Syslog.global.logHost field:
• udp://loghost.company.corp:514
• tcp://loghost.company.corp:514
• ssl://loghost.company.corp:1514

• Go to c:\ProgramData\VMware\VMware Syslog Collector\Data
• You should be able to see a folder created for each host called the host name

• If you go back to the Network Syslog collector and you are not seeing your hosts but you are getting logs collected in your designated location then log out and into vClient again

What you will see

• A folder has been created for every ESXi host, identified by the management IP address;
• In each folder a single file, named syslog.log, containing entries from the Hostd.log and the Vpxa.log

If logging does not show up, try the following:

• Check the configuration of the ESXi host, especially the syntax of the loghost
• Check the configuration of the ESXi firewall, outgoing syslog allowed
• On the ESXi host, try restarting the Managent Agent. From the DCUI or # /sbin/services.sh restart
• On the Syslog server, also check the firewall settings, is incoming traffic allowed?
• Try to connect to the Syslog server using the telnet command, e.g.: > telnet Syslog server> 514
• In case you use the “Network Syslog Collector”, review the settings
• Restart the vClient as this sometimes refreshes the Network Syslog Collector View

VMware Doc

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2003322