All product logs produced by VMware vCloud Director are stored on a cell's local disk [1]. The vCloud Director Security Hardening Guide mentions centrally logging everything for additional securitiy, but doesn't go into any detail on how to achieve this.
[1] The exception are audit event logs, which can be transmitted to a central syslog server.
The easiest way to do it is to modify the Log4j configuration that the product uses and add an additional appender to the loggers. You'll need to know the IP address or FQDN of the syslog server as well as what UDP port it is listening on. You'll also want to think about what level of logging information you want transmitted -- only errors & warnings, information, or debug level. The more fine-grained you go, the more data will be sent.
Prerequisites
1. You'll need a version of syslog that supports listening for remote connections. Modern versions of syslog as well as syslog-ng support this. There are other 3rd party syslog-compatible products as well. A quick Web search will tell you how to enable this for your particular log server and OS. Tip: for syslog the -r argument will enable it.
2. You'll need to ensure that the appropriate firewall ports are open on both the VCD host for outbound UDP traffic as well as on the syslog host for inbound UDP access (or you'll need need to set up the syslog server in a passive fashion).
Steps to enabling centralized logging
The steps below demonstrate how to add a new syslog appender that will transmit log messages that are INFO-level or above.
1. Log into your VCD cell using the console or SSH
2. Change directory (cd) to /opt/vmware/vcloud-director/etc
3. Make a backup of the logging configuration: cp log4j.properties log4j.properties.default
4. Edit log4j.properties in your preferred text editor and add the following lines:
log4j.appender.vcloud.system.syslog=org.apache.log4j.net.SyslogAppender
log4j.appender.vcloud.system.syslog.syslogHost=remoteSyslogHost.example.com
#Logs got to port 514 unless you specify a port, as in the disable example below.
#log4j.appender.vcloud.system.syslog.syslogHost=remoteSyslogHost.example.com:5555
log4j.appender.vcloud.system.syslog.facility=LOCAL1
log4j.appender.vcloud.system.syslog.layout=com.vmware.vcloud.logging.CustomPatternLayout
log4j.appender.vcloud.system.syslog.layout.ConversionPattern=%d{ISO8601} | %-8.8p | %-25.50t | %-30.50c{1} | %m | %x%n
log4j.appender.vcloud.system.syslog.threshold=INFO
You'll also want to modify line 2 of the file and append the name of the new syslog appender, as follows:
log4j.rootLogger=ERROR, vcloud.system.debug, vcloud.system.info, vcloud.system.syslog
5. Save the file and restart the cell: service vmware-vcd restart
If you consult your central syslog server you should now see logs from the cell appearing. You'll need to repeat the procedure for each cell in your VCD cluster.
Limitations
- Log4j's SyslogAppender only supports UDP. In order to use TCP or other more advanced syslog features you would need to modify the cell's runtime configuration, which is not supported by VMware (so I will not cover it here).
- As noted in the hardening guide, the Jetty request log is configured by Jetty programmatically so there is no way to centrally log the access and error information using Log4j short of using a separate log-collection utility.
References
