ESXi

 View Only

  • 1.  Does VMware support single line syslogs?

    Posted Jan 23, 2014 06:34 PM

    I have a client using VMware ESX v5 sending the logs to a SIEM.  The SIEM is receiving the logs, but some (or all) the logs it's receiving are multi-lined logs.  Is there a way to configure VMware to send single line logs only?  I did search through the forum looking through similar questions, so if I missed one that answers this specifically then I apologize, and please send me the discussion information to review.



  • 2.  RE: Does VMware support single line syslogs?

    Posted Jan 23, 2014 07:03 PM

    First of all, sometimes it is not possible, i.e. BSD-syslog is limited to 1024 bytes; if you want to log longer message, multiple lines are necessary (I just hope ESXi is using IETF-syslog). But what is more important, this is clearly job for log-collector.

    I do not know SIEM, but for example syslog-ng has option "no-multi-line". This option disables line-breaking. Log-server then waits for the whole message and reconstructs it back to single line. This can be easily done even with simple filters, as every new log-message begins with <PRI> (priority value).

    On the ESXi-side these multi-line messages could be maybe disabled by using tcp but I'm not sure it can be done somewhere in settings.



  • 3.  RE: Does VMware support single line syslogs?

    Posted Jan 23, 2014 07:14 PM

    I am actually referring to Syslog-ng as the collector.  I see in the admin guide the explanation of the "no-multi-line" option, and that may be what I'm looking for.  Aside from syslog-ng, is there no way then to configure how VMware sends logs: multi-line vs single lines.  Or does VMware just send a log in a stream with line breaks?



  • 4.  RE: Does VMware support single line syslogs?

    Posted Jan 23, 2014 07:23 PM

    There are only five configurable options for syslog. Check the KB article which talks about the same

    http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2003322



  • 5.  RE: Does VMware support single line syslogs?

    Posted Jan 23, 2014 07:32 PM

    Allow me to correct you: there are only five configurable options visible in vSphere-client. But if you do not mind getting a little dirty and dare to dig deep into /etc, apart from vmsyslog.conf you will find there sub-directory vmsyslog.conf.d with ~20 more config files. There is sure more to configure than those five options you see in vSphere-client! :-)



  • 6.  RE: Does VMware support single line syslogs?

    Posted Jan 23, 2014 07:35 PM

    Is it supported by VMware?



  • 7.  RE: Does VMware support single line syslogs?

    Posted Jun 09, 2014 10:35 PM

    Greetings,

    Im in the same situation.

    Using Trustwave's SIEM there are some logs that aren´t parsed correctly. SIEM support request change de VMWare syslog configuration to the standar. Only one line logs.

    Is there any way to do this?