What’s Syslog?

---

Syslog is a standard for message logging. It allows software to generating messages with a standard format and store the messages as log files on a local disk or shared storage for analyzing and troubleshooting.

Syslog has two standard components:

1. Syslog Client
2. Syslog Server

Syslog client is a software agent for collecting the software messages and store those messages as log file or send it to a remote server.

Syslog server is a remote server to receiving messages from remote clients and store messages on a storage as log file or log database.

What’s VMware Syslog Collector?

---

VMware Syslog Collector is Syslog server which provided by VMware as one of vSphere component. Syslog Collector will be installed as stand-alone server or integrated with vCenter server.

So when you purchased vSphere product, you have a Syslog server that fully compatible with ESXi, so there is no need to deploy another third-party Syslog server.

Configure Syslog via PowerCLI

---

Typically, Syslog will configure on ESXi via vSphere Client and vSphere Web Client but when you have more than one ESXi, configuring Syslog on ESXi is difficult.

So you can configure Syslog via PowerCLI. It allows you to configure Syslog on all ESXi servers by run some codes.

The below script will configure Syslog on ESXi and also configure ESXi firewall for open Syslog ports:

$hosts = Get-VMHost

#Configuring Syslog on ESXi Servers
$hosts | Set-VMHostAdvancedConfiguration Syslog.global.logHost -Value x.x.x.x
$hosts | Set-VMHostAdvancedConfiguration Syslog.global.logDirUnique -Value True

#Enable Syslog on Firewall
$hosts | Get-VMHostFirewallException | where {$_.Name.StartsWith('syslog')} |
Set-VMHostFirewallException -Enabled $true