How to Configure Syslog on VMware vSphere 8 ESXi Hosts

VMWARE TECHNICAL GUIDE

Remote syslog on ESXi 8 using the vSphere Client, ESXCLI, PowerCLI and Host Profiles, with the full advanced option reference, TLS, audit records and the verification step most guides skip.

ESXi writes its logs to a RAM disk by default. If a host crashes, reboots unexpectedly, or is rebuilt, anything not persisted is gone, which is precisely the log data you need at the moment you most need it. Configuring remote syslog is therefore not an optional hardening step. It is the difference between being able to explain an outage and not.

This guide covers every practical way to configure syslog on vSphere 8 ESXi hosts, the full set of advanced options with their ESXCLI equivalents, how to encrypt the transport, and how to verify it is actually working.

What this guide covers

• What changed in vSphere 8
• Prerequisites before you configure a single host
• Understanding the loghost string
• Four configuration methods: vSphere Client, ESXCLI, PowerCLI and Host Profiles
• The full advanced options reference
• Transport security, audit records, tuning and filtering
• Verification, common mistakes and FAQs

What changed in vSphere 8

The core mechanism is unchanged from vSphere 7. The syslog daemon is still vmsyslogd, settings are still exposed as Syslog.global.* advanced options, and ESXCLI is still the fastest way to configure them. Several things around it have moved, however.

• vSphere Configuration Profiles arrived. Introduced in vSphere 8.0 as the successor to Host Profiles, managing ESXi host configuration at cluster level and requiring only the delta from default rather than a full configuration capture. For new builds this is the direction of travel.
• TLS administration was simplified in 8.0 Update 3. TLS profiles replaced the older per-service cipher options, which affects how you reason about encrypted syslog transport.
• Message length handling changed in 8.0 Update 3i. Before that release, Syslog.global.remoteHost.maxMsgLen applied only to TCP and SSL, with UDP capped at 480 bytes for IPv4 and 1180 bytes for IPv6. From 8.0 Update 3i the parameter applies more broadly. If you are truncating long messages, your patch level matters.
• Audit records remain available. The Syslog.global.auditRecord options introduced in 7.0 Update 1 carry forward, and are required for NIAP-aligned configurations.

Before you start

Four things should be true before you configure a single host.

1. A syslog collector is reachable and listening. This might be VCF Operations for Logs, Splunk, Graylog, rsyslog, or a SIEM. Know the protocol and port it expects.
2. Persistent storage is configured on the host. Always configure persistent storage before setting Syslog.global.logDir or any audit record parameter. Setting a log directory that does not survive a reboot defeats the purpose.
3. Time is synchronised. NTP must be working on every host, or your log timeline will be unusable and correlation across hosts impossible.
4. The outbound firewall path is open. The ESXi firewall has a syslog ruleset, and any network firewall between the host management network and the collector must permit the protocol and port you have chosen.

Understanding the loghost string

Almost every syslog problem on ESXi comes down to a malformed or misunderstood Syslog.global.logHost value. The format is worth learning properly:

protocol://hostname|ipv4|[ipv6][:port][?formatter=value[&framing=value]]

Table 1 - Components of the ESXi remote syslog host specification.

You can specify multiple collectors as a comma-delimited list. There is no hard limit on the number of remote hosts, but keeping it to five or fewer is good practice. If the field is left blank, no logs are forwarded at all.

# Plain UDP on the default port
udp://10.20.30.40:514

# TCP, which gives you delivery acknowledgement
tcp://syslog.example.local:514

# Encrypted, with RFC 5424 structured messages and octet counting
ssl://syslog.example.local:1514?formatter=RFC_5424&framing=octet_counting

# Two collectors, comma separated
tcp://10.20.30.40:514,ssl://siem.example.local:1514

Method 1: the vSphere Client

Best for one host, or for checking what is already configured.

1. Log in to the vSphere Client and select the ESXi host in the inventory.
2. Go to Configure, then System, then Advanced System Settings, and click Edit.
3. Filter for Syslog.global.logHost and enter your remote host specification.
4. Optionally set Syslog.global.logDir to a persistent datastore path, and enable Syslog.global.logDirUnique if multiple hosts share that path.
5. Click OK. Changes made through the client take effect immediately, because the service is reloaded for you.

Method 2: ESXCLI

The fastest method, and the one to use when scripting or troubleshooting.

View the current configuration:

esxcli system syslog config get

Set a remote collector over TCP:

esxcli system syslog config set --loghost='tcp://10.20.30.40:514'

Set a persistent local log directory, a unique subdirectory per host, and rotation:

esxcli system syslog config set \
  --logdir='[datastore1] /systemlogs' \
  --logdir-unique=true \
  --default-rotate=8 \
  --default-size=1024

Then reload the service so the changes take effect:

esxcli system syslog reload

Method 3: PowerCLI for bulk configuration

For anything beyond a handful of hosts, do it once and apply it everywhere.

# Apply a remote syslog target to every host in a cluster
$loghost = "tcp://10.20.30.40:514"

Get-Cluster "Production" | Get-VMHost | ForEach-Object {
    Get-AdvancedSetting -Entity $_ -Name Syslog.global.logHost |
        Set-AdvancedSetting -Value $loghost -Confirm:$false

    # Open the ESXi firewall for outbound syslog
    $fw = Get-VMHostFirewallException -VMHost $_ -Name "syslog"
    Set-VMHostFirewallException -Exception $fw -Enabled $true
}

# Report on what is configured across the estate
Get-VMHost | Select-Object Name,
    @{N="LogHost";E={($_ | Get-AdvancedSetting -Name Syslog.global.logHost).Value}},
    @{N="LogDir";E={($_ | Get-AdvancedSetting -Name Syslog.global.logDir).Value}}

The reporting block is worth running on a schedule. Syslog configuration drifts, because hosts get rebuilt, added to the wrong cluster, or restored from an old profile, and drift is silent until you need the logs.

Method 4: Host Profiles

For a cluster of similar hosts on vSphere 8, Host Profiles remain a supported route. Configure syslog on a reference host using ESXCLI or the client, extract a profile from that host, and the syslog options appear under Advanced Configuration Options ready to be applied to the rest of the cluster.

If you are building new on vSphere 8, consider vSphere Configuration Profiles instead. It manages configuration at cluster level and requires you to specify only the deltas from default rather than capturing an entire reference configuration, which makes it far less unwieldy to maintain. Our companion guide on configuring syslog on VCF 9 hosts works through that model in detail.

The full advanced options reference

These are the settings you will actually use, with their ESXCLI equivalents.

Core options

Table 2 - Core ESXi syslog options.

Transport security

Table 3 - Certificate and transport security options.

Audit records

Table 4 - Audit record options.

Tuning and filtering

Table 5 - Tuning, filtering and queue management options.

Per-component logging

Individual subloggers can be tuned independently of the global defaults, which is useful when one noisy component is rolling your logs before anything else gets a chance to be recorded. Each component exposes its own rotate and size settings, for example Syslog.loggers.hostd.rotate and Syslog.loggers.hostd.size. You will find them under the syslog section of Advanced System Settings in the vSphere Client.

Opening the ESXi firewall

The host firewall has a syslog ruleset which must be enabled for outbound traffic to leave.

esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network firewall refresh

Verifying it actually works

This is the step that separates a configured host from a working one.

Confirm the port is reachable from the host:

nc -z 10.20.30.40 514

Inject a test message and confirm it arrives at the collector:

esxcli system syslog mark --message="Consult Circle syslog test"

If nothing arrives, check the syslog daemon error log on the host:

cat /var/log/.vmsyslogd.err

A "failed to write log" entry in that file usually means the host lost communication with the collector. Once that happens, nothing is forwarded until the service is reloaded, so a collector outage can silently stop logging long after the collector itself has recovered.

Common mistakes

• No persistent scratch configured, so local logs live on a RAM disk and vanish at reboot.
• Setting values with ESXCLI and forgetting esxcli system syslog reload.
• Multiple hosts logging to the same shared directory without Syslog.global.logDirUnique, so they overwrite one another.
• Using UDP to a collector across a congested link and assuming delivery. UDP has no acknowledgement, and messages are dropped silently.
• Enabling ssl:// without setting the certificate check option, or enabling CRL and strict X.509 outside a certification context.
• Leaving the ESXi firewall syslog ruleset disabled.
• Relying on an FQDN collector address on hosts whose DNS is not reliably available during boot.
• Never checking again. Syslog configuration drifts as hosts are rebuilt, and nothing tells you it has.

Where to go next

• How to Configure Syslog on VMware vSphere 9 ESX Hosts, including the log message format deprecation that will break existing parsers.
• How to Configure Syslog on VMware VCF 9 Hosts (ESX), for fleet-wide desired state with vSphere Configuration Profiles.
• How to Configure Syslog on VMware vSphere 7 ESXi Hosts, the predecessor to this guide.
• VCF Upgrade Services if you are moving these hosts onto VMware Cloud Foundation.

Frequently Asked Questions

How do I configure syslog on ESXi 8 from the command line?

Use esxcli system syslog config set --loghost='tcp://collector:514' followed by esxcli system syslog reload. The reload is required for ESXCLI changes to take effect.

Can ESXi send logs to more than one syslog server?

Yes. Syslog.global.logHost accepts a comma-delimited list. There is no hard limit, but keeping it to five or fewer collectors is recommended practice.

How do I encrypt syslog traffic from ESXi?

Use the ssl:// protocol in the loghost string, which defaults to port 1514, and enable Syslog.global.certificate.checkSSLCerts so the host validates the collector certificate.

Why are my ESXi logs not reaching the syslog server?

Check in this order: the ESXi firewall syslog ruleset, network reachability with nc -z, whether a reload was run after an ESXCLI change, and /var/log/.vmsyslogd.err for write failures.

What is the difference between RFC 3164 and RFC 5424 on ESXi?

RFC 3164 is the legacy BSD syslog format and is the ESXi default. RFC 5424 is the modern structured format with better timestamps and structured data support. Set it with the formatter parameter in the loghost string, if your collector supports it.

Where does ESXi store logs locally?

In /var/log, which is a RAM disk unless persistent storage is configured. Set Syslog.global.logDir to a persistent datastore path, and note that only /scratch on the local file system persists across reboots by default.

Do I need to restart the ESXi host after changing syslog settings?

No. Changes made in the vSphere Client take effect immediately, and ESXCLI changes take effect after esxcli system syslog reload. A host reboot is never required.