You can generate VMware Horizon events in Syslog format so that the event data can be accessible to analytics software.

You need to configure only one host in a Connection Server group. The remaining hosts in the group are configured automatically.

If you enable file-based logging of events, events are accumulated in a local log file. If you specify a file share, these log files are moved to that share.

  • The maximum size of the local directory for event logs, including closed log files, before the oldest files are deleted, is 300MB. The default destination of the Syslog output is %PROGRAMDATA%\VMware\VDM\events\.
  • Use a UNC path to save log files for a long-term record of events, or if you do not have a Syslog server or event database, or if your current Syslog server does not meet your needs.

You can alternatively use a vdmadmin command to configure file-based logging of events in Syslog format. See the topic about generating VMware Horizon event log messages in Syslog format using the -I option of the vdmadmin command, in the Horizon Administration document.

Important: When sending to a Syslog server, Syslog data is sent across the network without software-based encryption, and might contain sensitive data, such as user names. VMware recommends using link-layer security, such as IPSEC, to avoid the possibility of this data being monitored on the network.

Prerequisites

You need the following information to configure Connection Server so that events can be recorded in Syslog format or sent to a Syslog server, or both:

  • If you plan to use a Syslog server to listen for the VMware Horizon events on a UDP port, you must have the DNS name or IP address of the Syslog server and the UDP port number. The default UDP port number is 514.
  • If you plan to collect logs in a flat-file format, you must have the UNC path to the file share and folder in which to store the log files, and you must have the user name, domain name, and password of an account that has permission to write to the file share.

Procedure

  1. In Horizon Console, select Settings > Event Configuration.
  2. (Optional) In the Syslog area, to configure Connection Server to send events to a Syslog server, click Add below Send to syslog servers, and supply the server name or IP address and the UDP port number.
  3. (Optional) In the Events to File System area, choose whether or not to enable event log messages to be generated and stored in Syslog format in log files.
    Option Description
    Always Always generate and store event log messages in Syslog format in log files.
    Log to file on error (default) Log audit events to a log file when there is a problem writing events to the event database or the Syslog server. This option is enabled by default.
    Never Never generate and store event log messages in Syslog format in log files.
    The log files are retained locally unless you specify a UNC path to a file share.
  4. (Optional) To store the VMware Horizon event log messages on a file share, click Add below Copy to location, and supply the UNC path to the file share and folder in which to store the log files, along with the user name, domain name, and password of an account that has permission to write to the file share.
    An example of a UNC path is: 
    \\syslog-server\folder\file