Video - Install vSphere Syslog Collector and configure ESXi logging

Logging in vSphere 5.0 has been significantly enhanced. You now have fine-grained control over system logs, the location where logs are sent, and, for each log, default size and rotation policy. You can set up logging with the vSphere Client or with the esxcli system syslog command and the PowerCLI VMHostSysLogServer Commandlets. You can also set up logging behaviour for a host by using the Host Profiles interface in the vSphere Client and can then import that host profile into other hosts. VMware vSphere ESXi 5.0 hosts run a syslog service (vmsyslogd) which provides a standard mechanism for logging messages from the VMkernel and other system components. By default in ESXi, these logs are placed on a local scratch volume or a ram disk. To preserve the logs further, ESXi can be configured to place these logs to an alternate storage location on disk, and to send the logs across the network to a syslog server. You have to install the vSphere Syslog Collector to enable ESXi system logs to be directed to a server on the network, rather than to a local disk. It’s possible install the Syslog Collector on the same machine as the associated vCenter Server, or on a different machine that has network connection to the vCenter Server. The Syslog Collector service binds to an IPv4 address for communication with vCenter Server, and does not support IPv6. The vCenter Server can be on a host machine in an IPv4-only, IPv4/IPv6 mixed-mode, or IPv6-only network environment, but the machine that connects to the vCenter Server through the vSphere Client must have an IPv4 address for the Syslog Collector service to work. In the ESXi Software panel there's an Advanced Setting called Syslog.global.LogHost, the value of this setting presents the remote host to which syslog messages are forwarded and port on which the remote host receives syslog messages. You can include the protocol and the port, for example, ssl://hostName1:514. UDP (default), TCP, and SSL are supported. The remote host must have syslog installed and correctly configured to receive the forwarded syslog messages. Checkout the video how the syslog service is installed on the vCenter host. You can also set up ESXi Syslog from the Host Profiles Interface. Hosts provisioned with Auto Deploy usually do not have sufficient local storage to save system logs. You can specify a remote syslog server for those hosts by setting up a reference host, saving the host profile, and applying that host profile to other hosts as needed. Best practice is to set up the syslog server on the reference host with the vSphere Client or the esxcli system syslog command and save the host profile. In some situations, setting up syslog from the Host Profiles interface is an alternative.