One of the new features of vSphere 5 is the possibility of centralizing the logs of our ESXi hosts on a Syslog server thanks to the VMware Syslog Collector tool. It will allow us to store as many logs as we are interested in, allowing greater agility when looking for solutions to possible problems we have.

From VMware vSphere DVD 5, we can install VMware Syslog Collector on any computer on the network to centralize the logs of our hosts, “Install”,

The log collector installation wizard will come out, “Next”,

We accept the patent agreement, “Next”,

We accept the license usage agreement, “Next”,

We select the installation path for vSphere Syslog Collector (Default Directory: %ProgramFiles (x86%)VMwareVMware Syslog Collector”, as well as the directory where we will store the logs, We will indicate the maximum size of each log file (2Mb by default) and the maximum number of logs to be maintained. “Next”,

We may perform a standalone installation or integrate with an existing vCenter installation, “Next”,

In my case, to register it in vCenter we will provide the server information, “Next”,

The default listening port of the syslog will be the 514 Both TCP and UDP, and SSL port on 1514. “Next”,

We indicate how they will see us from vCenter, if by name or IP, “Next”,

Click on “Install” to begin installation,

… Wait a few seconds…

List, we hit Finish to start configuring our ESXi hosts against this log collector.

About each ESXi host that we are interested in forcing the sending of Log's to our syslog, from the “Configuration” > “Advanced Settings”

We will modify the parameter “Syslog.global.logHost” in “Syslog” with the following information: We will first indicate the protocol (UDP/TCP/SSL), then the IP address of the Syslog Collector and finally the port. By default it will be: UDP://DIRECCIÓN_IP:514

Once the hosts are configured, we can confirm it from the Home view, in “Network Syslog Collector”,

We will see the properties of our collector plus the servers that are sending us logs.

Default, we will store the logs in the Syslog Collector in “%ProgramFiles (x86%)VMwareVMware Syslog CollectorDataDIRECCIÓN_IP_HOST” where we can keep a centralized history for as long as we are interested.