You can use the vSphere Web Client or the esxcli system syslog vCLI command to configure the syslog service.

For information about using the esxcli system syslog command and other vCLI commands, see Getting Started with vSphere Command-Line Interfaces.


  1. In the vSphere Web Client inventory, select the host.
  2. Click Configure.
  3. Under System, click Advanced System Settings.
  4. Filter for syslog.
  5. To set up logging globally, select the setting to change and click Edit.
    Option Description Maximum number of archives to keep. You can set this number globally and for individual subloggers. Default size of the log, in KB, before the system rotates logs. You can set this number globally and for individual subloggers. Directory where logs are stored. The directory can be located on mounted NFS or VMFS volumes. Only the /scratch directory on the local file system is persistent across reboots. Specify the directory as [datastorename] path_to_file, where the path is relative to the root of the volume backing the datastore. For example, the path [storage1] /systemlogs maps to the path /vmfs/volumes/storage1/systemlogs. Selecting this option creates a subdirectory with the name of the ESXi host under the directory specified by A unique directory is useful if the same NFS directory is used by multiple ESXi hosts. Remote host to which syslog messages are forwarded and port on which the remote host receives syslog messages. You can include the protocol and the port, for example, ssl://hostName1:1514. UDP (default), TCP, and SSL are supported. The remote host must have syslog installed and correctly configured to receive the forwarded syslog messages. See the documentation for the syslog service installed on the remote host for information on configuration.
  6. (Optional) To overwrite the default log size and log rotation for any of the logs.
    1. Click the name of the log that you want to customize.
    2. Click Edit and enter the number of rotations and the log size you want.
  7. Click OK.


Changes to the syslog options take effect immediately.