How to use a Rsyslog server to store ESXi Host logs

Install and configure Rsyslog server

Generally speaking, Rsyslog is already installed when the Linux system is installed. If not, please install it manually.

a. Install Rsyslog Server

[root@rsyslog /] # yum-y install syslog

b. Boot self-boot Rsyslog Server

[root@rsyslog /] # systemctl enable rsyslog

c. Turn off the firewall or open the firewall port

Turn off the firewall

[root@rsyslog /] # systemctl stop firewalld

[root@rsyslog /] # systemctl disable firewalld

Open the firewall port

[root@rsyslog /] # firewall-cmd-permanent-add-port=514/udp

[root@rsyslog /] # firewall-cmd-- reload

d.

[root@rsyslog /] # vim / etc/rsyslog.conf

Add custom configuration statements for log storage rules of remote hosts

Template (name= "Esxi" type= "list") {

Constant (value= "/ var/log/esxi")

Property (name= "fromhost-ip")

Constant (value= "/")

Property (name= "programname" SecurePath= "replace")

Constant (value= ".log")

} / / * template is a bit like defining a function ()

*. *? Esxi / / *. *? Esxi is a bit like executing function () defined above. If you don't write this statement, the configuration will not take effect.

e. Restart Rsyslog

[root@rsyslog /] # systemctl restart rsyslog

f. Configure the ESXi log level

The default log level of ESXi is that info,info-level logs are filled with too much useless information, and the amount of information is growing too fast.

Edit the Advanced Settings of the ESXi host and set the value of Config.HostAgent.log.level to warring or error.

g.

Edit the "security profile" of the ESXi host and open ports 514 and 1514 of syslog

Or the SSH ESXi host, execute the command esxcli system syslog config set-loghost= "udp://host_ip:514"

Esxcli system syslog reload

Test whether the connection is successful: nc-z host_ip 514

Reference documentation https://kb.vmware.com/articleview?docid=2003322&lang=zh_CN

h. Confirm whether the corresponding log file is generated under the defined folder