vmsyslog logger xx.xx.xx.x lost # log messages

[andvm]

Hi,

Is there anything that can be investigated to prevent such logs being missed to be sent to the syslog server?

I see this message on different hosts (6.5 and 6.7) and am wondering if I can do anything to find the cause?

Should ESXI's be left with logging level at Informational (Default) or this generates excessive logs/traffic?

What free Syslog Server do you use or recommend?

Thanks

[daphnissov]

Most common cause are issues at your syslog server either being unavailable or having performance problems.

[andvm]

there are tens of servers pointing to the same syslog server so will check basics CPU/RAM/Network utilization

If in meantime anyone can offer other insights as to what logging level you set the ESXi's and syslog server you use that would be great

[daphnissov]

As far as logging levels go, stay at defaults unless troubleshooting. As for syslog servers, vRealize Log Insight, Splunk, and SolarWinds are what I most often see.