ESXi Log Files

Log files are an important component of troubleshooting attacks and obtaining information about breaches. Logging to a secure, centralized log server can help prevent log tampering. Remote logging also provides a long-term audit record.

To increase the security of the host, take the following measures

• Configure persistent logging to a datastore. By default, the logs on ESXi hosts are stored in the in-memory file system. Therefore, they are lost when you reboot the host, and only 24 hours of log data is stored. When you enable persistent logging, you have a dedicated activity record for the host.
• Remote logging to a central host allows you to gather log files on a central host. From that host, you can monitor all hosts with a single tool, do aggregate analysis, and search log data. This approach facilitates monitoring and reveals information about coordinated attacks on multiple hosts.
• Configure the remote secure syslog on ESXi hosts by using a CLI such as vCLI or PowerCLI, or by using an API client.
• Query the syslog configuration to make sure that the syslog server and port are valid.

See the vSphere Monitoring and Performance documentation for information about syslog setup, and for additional information on ESXi log files.