> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# VMware vSphere

> Forward syslog from VMware vCenter Server and ESXi hosts

## Set up

One integration receives both vCenter Server and ESXi syslog. Follow the shared [Log Forwarders](https://docs.wirespeed.co/integrations/log-forwarders.md) guide to add **VMware vSphere** and open **Forwarder Details** (or ask Chat for the listener `ip:port`).

### vCenter Server

1. Sign in to the vCenter Server Management Interface (`https://<vcenter>:5480`) as `root`
2. Select **Syslog**. In **Forwarding Configuration**, click **Configure** (or **Edit** if a server is already set up)
3. Enter the server address and port from **Forwarder Details**, and set **Protocol** to match its transport (UDP, TCP, or TLS). Up to three servers are supported
4. Click **Save**, then click **Send Test Message**. Over UDP, the status may show **Unknown** even when delivery works
5. To forward vCenter events, open the vSphere Client, select the vCenter Server, and go to **Configure** > **Settings** > **Advanced Settings** > **Edit Settings**. Filter for `vpxd.event`, make sure `vpxd.event.syslog.enabled` is turned on, and click **Save**. Only events generated after this point are sent
6. Events will begin showing up shortly

### ESXi hosts

1. In the vSphere Client, select the host, then go to **Configure** > **System** > **Advanced System Settings** > **Edit** and filter for `syslog`
2. Set `Syslog.global.logHost` to the listener with its protocol and port, for example `udp://<ip>:<port>` or `tcp://<ip>:<port>` (use `ssl://<ip>:<port>` for TLS), and click **OK**
3. On ESXi 8.0 U2 and earlier, go to **Configure** > **System** > **Firewall** > **Edit**, select the **syslog** rule set on the **Ungrouped** tab, and click **OK**. ESXi 8.0 U3 and later open the syslog port automatically
4. Repeat for each host, or run `esxcli system syslog config set --loghost='<value>'`, then `esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true`, then `esxcli system syslog reload`

If **Forwarder Details** shows **TLS: Enabled**:

* **ESXi**: add the CA that issued Wirespeed's certificate to each host's trust store, with `esxcli system security certificatestore add -f <ca.pem>` or by publishing it to vCenter and selecting **Certificates** > **Refresh CA Certificates** on the host. Then run `esxcli system syslog config set --check-ssl-certs=true` and `esxcli system syslog reload`
* **vCenter**: vCenter must trust the CA that issued Wirespeed's certificate

See [Syslog over TLS](https://docs.wirespeed.co/integrations/log-forwarders.md#syslog-over-tls).

## Parsed events

Each line is tagged with its product (`vcenter` or `esxi`) and a stream:

* **vCenter events** (`vpxd_event`): event key, part, creation time, `vim.event` type, severity, user, target, chain ID, and message. Bad username session events are normalized as failed sign-ins. vCenter splits long events into numbered parts that share the event key; each part is stored as received. This stream requires `vpxd.event.syslog.enabled`.
* **Single sign-on** (`sso`, `websso_audit`): Security Token Service sign-in successes and failures are normalized as sign-ins, with the user, tenant, provider, and correlation ID when present. SSO audit events keep their user, client IP, and type; login events among them are normalized as sign-ins, with the response code when the description includes one.
* **Directory** (`vmdir`): blocked logins against locked accounts are flagged as lockouts.
* **Appliance audit** (`vcsa_audit`): auditd records with their keys. `USER_LOGIN` records are normalized as sign-ins.
* **ESXi** (`esxi_hostd`, `esxi_vobd`, `esxi_sshd`, `esxi_shell`): accepted and rejected host passwords and SSH logins are normalized as sign-ins. Account lockouts and SSH or ESXi Shell enablement are flagged, and shell commands are kept with their user. The `[Originator@6876 …]` context (operation ID, session, user) is stored when it appears in the RFC 5424 header or ahead of a hostd or other vmacore message, and lines cut short by ESXi's remote length limit are marked as truncated.

Lines from other vSphere services are kept under the `other` stream with their app name and message.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.