Skip to main content

​
Set up

One integration receives both vCenter Server and ESXi syslog. Follow the shared Log Forwarders guide to add VMware vSphere and open Forwarder Details (or ask Chat for the listener ip:port).

​
vCenter Server

  1. Sign in to the vCenter Server Management Interface (https://<vcenter>:5480) as root
  2. Select Syslog. In Forwarding Configuration, click Configure (or Edit if a server is already set up)
  3. Enter the server address and port from Forwarder Details, and set Protocol to match its transport (UDP, TCP, or TLS). Up to three servers are supported
  4. Click Save, then click Send Test Message. Over UDP, the status may show Unknown even when delivery works
  5. To forward vCenter events, open the vSphere Client, select the vCenter Server, and go to Configure > Settings > Advanced Settings > Edit Settings. Filter for vpxd.event, make sure vpxd.event.syslog.enabled is turned on, and click Save. Only events generated after this point are sent
  6. Events will begin showing up shortly

​
ESXi hosts

  1. In the vSphere Client, select the host, then go to Configure > System > Advanced System Settings > Edit and filter for syslog
  2. Set Syslog.global.logHost to the listener with its protocol and port, for example udp://<ip>:<port> or tcp://<ip>:<port> (use ssl://<ip>:<port> for TLS), and click OK
  3. On ESXi 8.0 U2 and earlier, go to Configure > System > Firewall > Edit, select the syslog rule set on the Ungrouped tab, and click OK. ESXi 8.0 U3 and later open the syslog port automatically
  4. Repeat for each host, or run esxcli system syslog config set --loghost='<value>', then esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true, then esxcli system syslog reload
If Forwarder Details shows TLS: Enabled:
  • ESXi: add the CA that issued Wirespeed’s certificate to each host’s trust store, with esxcli system security certificatestore add -f <ca.pem> or by publishing it to vCenter and selecting Certificates > Refresh CA Certificates on the host. Then run esxcli system syslog config set --check-ssl-certs=true and esxcli system syslog reload
  • vCenter: vCenter must trust the CA that issued Wirespeed’s certificate
See Syslog over TLS.

​
Parsed events

Each line is tagged with its product (vcenter or esxi) and a stream:
  • vCenter events (vpxd_event): event key, part, creation time, vim.event type, severity, user, target, chain ID, and message. Bad username session events are normalized as failed sign-ins. vCenter splits long events into numbered parts that share the event key; each part is stored as received. This stream requires vpxd.event.syslog.enabled.
  • Single sign-on (sso, websso_audit): Security Token Service sign-in successes and failures are normalized as sign-ins, with the user, tenant, provider, and correlation ID when present. SSO audit events keep their user, client IP, and type; login events among them are normalized as sign-ins, with the response code when the description includes one.
  • Directory (vmdir): blocked logins against locked accounts are flagged as lockouts.
  • Appliance audit (vcsa_audit): auditd records with their keys. USER_LOGIN records are normalized as sign-ins.
  • ESXi (esxi_hostd, esxi_vobd, esxi_sshd, esxi_shell): accepted and rejected host passwords and SSH logins are normalized as sign-ins. Account lockouts and SSH or ESXi Shell enablement are flagged, and shell commands are kept with their user. The [Originator@6876 …] context (operation ID, session, user) is stored when it appears in the RFC 5424 header or ahead of a hostd or other vmacore message, and lines cut short by ESXi’s remote length limit are marked as truncated.
Lines from other vSphere services are kept under the other stream with their app name and message.