Directing vCenter server to syslog server

[vmproteau]

A VMware support engineer read a blurb that you could redirect to a syslog server. I knew you could with ESX but, the blurb included vCenter although, he couldn't find specific information about how to configure it.

Anyone know if it is possible without the aid of some underlying helper software.

[lamw]

Yep, take a look at this blog article that explains it and where to make the change - http://www.virtuallyghetto.com/2010/06/esxi-syslog-caveat.html

In vSphere 4.1, this has been resolved, but prior to 4.1, this issue exists.

=========================================================================

William Lam

VMware vExpert 2009,2010

VMware scripts and resources at:

Twitter: @lamw

Getting Started with the vMA (tips/tricks)

Getting Started with the vSphere SDK for Perl

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Community

If you find this information useful, please award points for "correct" or "helpful".

[vmproteau]

Thanks. This will be helpful but, for this discussion I was specifically referring to vCenter server logs. I didn't see any mention of vCenter logs in the article.The blurb the support engineer read to me over the phone specifically mentioned vCenter in addition to the Hosts themselves. Is this possible?

[RParker]

In vSphere 4.1, this has been resolved, but prior to 4.1, this issue exists.

Yes, I have to agree, it's very informative for ESX, but NOT for vCenter (which is where ALL the logging should be). If we have 30 hosts, I don't want to update 1 host, reboot, and change each and every host.

Also what has been resolved.. the problem with logging in ESX or a WAY to do this strictly from vCenter.

[RParker]

This will be helpful but, for this discussion I was specifically referring to vCenter server logs.

http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=1024122&sl...

Interestingly this DOES suggest vCenter CAN be redirected.. to VMA.

Run this command to enable the vilogger interface and to configure vMA to collect log files from the target ESX/ESXi or vCenter Server hosts according to the specified log policy:

[lamw]

Yes, these are the same vpxa logs that are on the ESX(i) host ...the initial issue was if you enabled syslog on the host, only the vpxa logs were not being collected. The article I mentioned, allows for the collection of vpxa log to be forwarded to syslog which is what is being done when you use vMA, either one works but if you don't use vMA as your primary syslog server, then you need to perform the tweak.

=========================================================================

William Lam

VMware vExpert 2009,2010

VMware scripts and resources at:

Twitter: @lamw

Getting Started with the vMA (tips/tricks)

Getting Started with the vSphere SDK for Perl

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Community

If you find this information useful, please award points for "correct" or "helpful".

[vmproteau]

So it does. This may have been what the engineer was referring to although the KB doesn't go into much detail with respect to vCenter. I may open a case and reference the KB. I'm looking to push C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\Logs data to syslog if possible.

[vmproteau]

Support is saying the reference to vCenter in the KB is likely a misprint. I may test with my lab vCenter and VMA as a syslogging server to see if the developers put this in there without support being fully aware. The engineer suggested that was a possibility but, I think a misprint is more liklely.

[RParker]

The engineer suggested that was a possibility but, I think a misprint is more liklely.

Well it's NOT a misprint, because it does work. When I enabled it, I did a check from VMA, and a couple of ESX host's are ALREADY redirecting to my vCenter folder, which is created under the log/vmware/vcentername.

So it DOES work.. however is only the vpxa.log... I am looking for the vCenter logs like tasks/events to be somewhere I can sort back through them. It rolls off after 100 entries, and they just get lost, but sometimes we like to investigate inventory from a couple months back.