The commands vicfg-syslog.pl (esxcfg-syslog.pl) allow you to set a remote syslog server for an ESXi 3.5 host. This command will not work on ESX 3.5 hosts. If you connect via a VirtualCenter host with the –server option, you must then specify the ESXi host with the -h/–vihost <host> option. Once the settings are configured, there is no need to start or stop the syslog agent.
To show current syslog configuration use this command.
vicfg-syslog.pl –server <server_name> -i or vicfg-snmp.pl –server <server_name> –show
To set the port for the syslog server use this command.
vicfg-syslog.pl –server <server_name> -p <port> or vicfg-snmp.pl –server <server_name> –setport <port>
To set the hostname or IP for the syslog server use this command.
vicfg-syslog.pl –server <server_name> -s <syslog server> or vicfg-snmp.pl –server <server_name> –setserver <syslog server>
The below image displays some sample messages sent from an ESXi host and the amount of messages sent in a short time frame can be quite large.
It is possible to set the syslog server and port from within the VI client. With the VI client (but not the vicfg-syslog.pl command) it is also possible to configure ESXi to write syslog messages to a text file on a VMFS datastore that the ESXi host has access to. This is shown in the below image. It is necessary to format Syslog.Local.DatastorePath value as [<datastore_name>]/<folder_name>/<file_name>. Folder_name is optional.
