After you enable remote streaming, vCenter Server starts streaming and only the newly generated events are streamed to the remote syslog server.
All syslog messages begin with a specific prefix. You can distinguish the vCenter Server events from other syslog messages by their Event prefix.
The syslog protocol limits the length of syslog messages to 1024 characters. Messages that are longer than 1024 characters split into multiple syslog messages.
<syslog-prefix> : Event [eventId] [partInfo] [createdTime] [eventType] [severity] [user] [target] [chainId] [desc]
|syslog-prefix||Displays the syslog prefix. The
|eventId||Displays the unique ID of the event message. The default value is Event.|
|partInfo||Displays whether the message is split into parts.|
|createdTime||Displays the time when the event was generated.|
|eventType||Displays the event type.|
|severity||Displays whether the event is a piece information, a warning, or an error.|
|user||Displays the name of the user who generated the event.|
|target||Displays the object the event refers to.|
|chainId||Displays information about the parent or the group ID.|
|desc||Displays the description of the event.|
Split of Long Event Message into Multiple Syslog Messages
<syslog-prefix> : Event [eventId] [1-X] [payload-part-1] <syslog-prefix> : Event [eventId] [2-X] [payload-part-2] ... <syslog-prefix> : Event [eventId] [X-X] [payload-part-X]
The X stands for the number of the event message parts.