ESXi hosts or vSphere Appliance instances generate unstructured log data that can be analyzed in vRealize Log Insight Cloud.

You use the vRealize Log Insight Cloud interface to configure ESXi hosts on a registered vCenter Server to push syslog data to vRealize Log Insight Cloud.
Caution: Running parallel configuration tasks might result in incorrect syslog settings on the target ESXi hosts. Verify that no other administrator is configuring the ESXi hosts that you intend to configure.

For information about filtering syslog messages on ESXi hosts before messages are sent to vRealize Log Insight Cloud, see Configure Log Filtering on ESXi Hosts in the VMware ESXi Installation and Setup guide.

For information about configuring syslog feeds from a vCenter Server Appliance, see Configuring the vCenter Server to Forward Log Events to vRealize Log Insight Cloud.

Note: vRealize Log Insight Cloud can receive syslog data from ESXi hosts version 6.x and later.

Prerequisites

  • Verify that the vCenter Server that manages the ESXi host is registered with your vRealize Log Insight Cloud service. Or, you can register the ESXi host and configure vCenter Server in a single operation.
  • Verify that you have user credentials with enough privileges to configure syslog on ESXi hosts.
    • Host.Configuration.Advanced settings
    • Host.Configuration.Security profile and firewall
    Note: You must configure the permission on the top-level folder within the vCenter Server inventory, and verify that the Propagate to children check box is selected.
  • Verify that you are logged in to the vRealize Log Insight Cloud web user interface as an administrator.

Procedure

  1. Click the two arrows icon in the upper-left corner of the screen to expand the main menu.
  2. Navigate to Configuration > vSphere Integration.
  3. Locate the vCenter Server instance that manages the ESXi host from which you want to receive syslog feeds, and click the instance.
  4. Select the Configure ESXi hosts to send logs to vRealize Log Insight Cloud check box.

    By default, vRealize Log Insight Cloud configures all reachable ESXi hosts of version 6.x and later to send their logs through UDP. ESX is not supported, and existing syslog targets on these hosts are not removed.

  5. (Optional) To modify the default configuration values, click Advanced Options. The ESXi hosts are listed with additional information such as host name, version, build, and whether they have been configured.
    Do the following:
    1. Select the Automatic or Manual option to configure hosts. If you select Automatic and then configure all the hosts, new hosts are automatically configured when added. If you select Manual and then configure all the hosts, you have to configure new hosts manually when added.
    2. Optionally, select TCP as the protocol to send logs.
    3. Select one or more hosts and click Configure. If you configure all the hosts, newly added hosts are configured automatically or need manual configuration, based on your selection.
      You can also undo host configurations by clicking Unconfigure.
  6. Click Save.

What to do next

The ESXi host configurations are shown in the ESXi hosts configured column of the vCenter Server table. If the hosts are configured, you can click View details to view detailed information for the configured ESXi hosts.