Modify an ESXi Host Configuration for Forwarding Log Events to vRealize Log Insight

ESXi hosts or vCenter Server Appliance instances generate unstructured log data that can be analyzed in vRealize Log Insight.

You use the vRealize Log Insight Integration interface to configure ESXi hosts on a registered vCenter Server to push syslog data to vRealize Log Insight.

Caution: Running parallel configuration tasks might result in incorrect syslog settings on the target ESXi hosts. Verify that no other user is configuring the ESXi hosts that you intend to configure.

After the initial configuration is set up, you can enable an option to periodically look for and automatically configure both existing and newly added vSphere ESXi hosts that are not configured yet. The currently configured protocol is used to configure the ESXi hosts automatically.

A vRealize Log Insight cluster can use an integrated load balancer to distribute ESXi and vCenter Server Appliance syslog feeds between the individual nodes of the cluster.

For information on filtering syslog messages on ESXi hosts before configured messages are sent to vRealize Log Insight, see the Configure Log Filtering on ESXi Hosts topic in the Setting Up ESXi section, of the vSphere Installation and Setup guide.

For information on configuring syslog feeds from a vCenter Server Appliance, see Configure vCenter Server to Forward Log Events to vRealize Log Insight.

vRealize Log Insight can receive syslog data from ESXi hosts version 5.5 and later.

Prerequisites

• Verify that the vCenter Server that manages the ESXi host is registered with your vRealize Log Insight instance.
• Verify that you have user credentials with enough privileges to configure syslog on ESXi hosts.
  • Host.Configuration.Advanced settings
  • Host.Configuration.Security profile and firewall
  Note: You must configure the permission on the top-level folder within the vCenter Server inventory, and verify that the Propagate to children check box is selected.

Procedure

1. Expand the main menu and navigate to Integration > vSphere.
2. Select the Configure ESXi hosts to send logs to Log Insight check box.
3. Click Advanced Options.
4. To change the protocol for selected ESXi hosts, use the following steps:
   1. Select one or more hosts from the Filter by host list.
   2. Verify that the current protocol is what you want, or select another protocol.
   3. To enable the automatic configuration of ESXi hosts with the currently configured protocol, select Automatically configure all ESXi hosts. When enabled, vRealize Log Insight periodically looks for and configures both existing and newly added vSphere ESXi hosts that are not configured yet.
   4. Click Configure to begin the configuration of the selected hosts. The ESXi dialog box closes.
   5. Click OK in the message dialog box.
   6. If you changed the protocol setting, click Save in the main window after you close the ESXi configuration dialog box.
5. (Optional) If you are using clusters, you can specify a load balancer by opening the drop-down menu for the Target text box on the vSphere Integration page and selecting the hostname or IP address for the load balancer.