vCenter 6.7 syslog auto stop

[qq89267388]

hi i have a vCenter 6.7.0.42000 15132721

I config a syslog to my logstash,

when i config it the syslog server can receive the log.

but some hours later the syslog server can't receive....

Both TCP and UDP are the same

i don't known how to solve...

[NathanosBlightc]

Hi

Does it happen only for your vCenter server or other nodes that you are monitored them have the same problem too?

Did you ever configured this syslog server only to recieve log files of ESXi host directly without vCenter intevention?

[qq89267388]

hi Amin

Thanks for you reply, i just only one vCenter

My syslog server only receive the vCenter log.

Although i config the ESXi send log to this log server,but i never receive the log...

Now i need vCenter log and i can receive this log but they are stoped by themself ....

[NathanosBlightc]

Please check the following log files in the corresponding path for any issue that maybe show you something related to this problem:

/storage/log/vmware/applmgmt-audit/applmgmt-audit-syslog.log

/storage/log/vmware/rsyslogd/rsyslogd-syslog.log

[aslk5 · Accepted solution]

Could it be this:

Rsyslog in vCenter 6.7U3 (Photon OS) stops working ~10min after starting

Rsyslog in vCenter 6.7U3 (Photon OS) stops working ~10min after starting : vmware

The reddit post says there will be a fix in the next update to vcenter.

[qq89267388]

hi aslk5

thanks for your reply

i use the post update the syslog

now everything work fine.

thank very much