Consider the following questions about syslog processing before moving to the VMware Smart Assurance-specific deployment design:
How will the syslog file be created?
If the syslogs for a number of systems must be monitored, a typical application has the systems send the syslog messages to a UNIX host running a syslog daemon as a receiver for systems’ messages. The syslog daemon then writes the messages to a combined syslog file. Applications other than syslog daemon can create files that the Syslog Adapter can read.
Where will the syslog file be located?
The Syslog Adapter must be able to access the file. The monitored devices must be able to send messages to the system where the file will be compiled.