Forward vCenter Server Appliance Log Files to Remote Syslog Server

You can forward the vCenter Server Appliance log files to a remote syslog server to conduct an analysis of your logs.

Note: ESXi can be configured to send log files to a vCenter Server rather than storing them to a local disk. The recommended maximum numbers of supported hosts to collect logs from is 30. See http://kb.vmware.com/s/article/2003322 for information on how to configure ESXi log forwarding. This feature is intended for smaller environments with stateless ESXi hosts. For all other cases, use a dedicated log server. Using vCenter Server to receive ESXi log files might impact vCenter Server performance.

Prerequisites

Log in to the vCenter Server Appliance Management Interface as root.

Procedure

1. In the vCenter Server Appliance Management Interface, select Syslog.
2. In the Forwarding Configuration section, click Configure if you have not configured any remote syslog hosts. Click Edit if you already have configured hosts.
3. In the Create Forwarding Configuration pane, enter the server address of the destination host. The maximum number of supported destination hosts is three.
4. From the Protocol drop-down menu, select the protocol to use.

   Menu Item	Description
   TLS	Transport Layer Security
   TCP	Transmission Control Protocol
   RELP	Reliable Event Logging Protocol
   UDP	User Datagram Protocol

5. In the Port text box, enter the port number to use for communication with the destination host.
6. In the Create Forwarding Configuration pane, click Add to enter another remote syslog server.
7. Click Save.
8. Verify that the remote syslog server is receiving messages.
9. In the Forwarding Configuration section, click Send Test Message.
10. Verify on the remote syslog server that the test message was received.
    The new configuration settings are shown in the Forwarding Configuration section.