I've been able to send the logs of ESXi 5.5 to a Ubuntu Linux rsyslogd server. Most of them are redirected to a file based on their faciliity, local4. But I saw that there were a lot of messages from vmkernel showing up in the regular syslog file. Using a custom format allowed me to determine that vmkernel uses the local6 syslog facility. But redirecting local6.* to my file doesn't get rid of all the logs. There are still entries from syslog, crond, smartd, and shell.
How can I set all logs to use a certain facility? I looked at /etc/vmsyslog.conf.d and the files do not appear to have the ability for me to set a facility.
For example, /etc/vmsyslog.conf.d/esxshell.conf
[vmsyslog-logger]
# unique id for this logger
id = shell
# description of this logger
descr = ESX shell logs
# idents this logger is interested in
idents = shell,ESXShell,SSH
# output file (e.g. foo == /var/log/foo.log)
file = shell
# file logger class
fclass = FileLoggerSyslog
# network logger class
nclass = NetworkFilterSyslogTimestamp
Its format is unlike /etc/vmware/hostd/config.xml which contains syslog facility.
Thanks
