Event Logs vs. Syslogs

[danh2010]

Under Event Configuration, there is a spot to setup an event database and a spot to setup syslogging.

What is the difference?

I am thinking that having the syslog server setup would be better?

[mittim12 · Accepted solution]

I think the decision lies in what you are more comfortable with and what you may already have setup.   The users who are upgrading from previous versions that already have events databases configured may stay with that where as someone who is new and has existing syslog infrastructure may opt for that method. 

[danh2010]

OK, so thery both log the same thing then.  Perfect.  Thanks!

[TedH256]

danh2010 wrote:

OK, so thery both log the same thing then.  Perfect.  Thanks!

sweet - I did not know that 5.2 moved away from requiring a database for events logging - syslog strikes me as a MUCH better alternative ....

[danh2010]

It doesn't....I just swapped one of my View servers and it alerted me that I don't have an event db in place.

That's ridiculous.  If I am logging by syslog, why should it care if I don't have an events db in place?

[TedH256]

danh2010 wrote:

It doesn't....I just swapped one of my View servers and it alerted me that I don't have an event db in place.

That's ridiculous.  If I am logging by syslog, why should it care if I don't have an events db in place?

ahhh ...

well then it must be as it has been: events logging is very detailed, and correlates user and desktop activity, and etc ...

I think syslog is more general "system level" logging that does not capture user and/or desktop level activity ....

*I think*

[danh2010]

I've got them both turned on now.  Our auditors are sticklers.

[mittim12]

Page 122 of the install guide, http://pubs.vmware.com/view-52/topic/com.vmware.ICbase/PDF/horizon-view-52-installation.pdf, states "You can generate View events in Syslog format so that the event data can be accessible to analytics software".     It sounds to me like it would be the same information.   Maybe once someone has it setup and working correctly they can confirm the consistency of the data between events database and syslog format.  

[danh2010]

OK, but once the Log to File is enabled, will View automatically send this info to the syslog server AND not generate an alert for the Event db?

My tests show no, still alerts.