I have changed Syslog in the VAMI to syslog.mydomain.com TCP 514, I changed the advaced settings on the ESXi host to the same URL. Splunk is gettng logs but they are not in the correct format according to the third party Splunk support we have.
They want me to change the following.
On the vcenter deployment, under /etc/rsyslog.conf you will want your conf to look like below (Replace <IP/HOSTNAME> with the IP address of the hostname of the machine where you want to receive the vCSA logs.)
$template vclogtemplate,"%syslogtag% %rawmsg%"
$ModLoad imfile
$InputFileName /var/log/vmware/vpxd/vpxd.log
$InputFileTag vpxd
$InputFileStateFile state-vpxd
$InputFileSeverity all
$InputRunFileMonitor
$ModLoad imfile
$InputFileName /var/log/vmware/vpxd/vpxd-profiler.log
$InputFileTag vpxd-profiler
$InputFileStateFile state-vpxd-profiler
$InputFileSeverity all
$InputRunFileMonitor
$ModLoad imfile
$InputFileName /var/log/vmware/vpxd/vpxd-alert.log
$InputFileTag vpxd-alert
$InputFileStateFile state-vpxd-alert
$InputFileSeverity all
$InputRunFileMonitor
*.* @@<IP/HOSTNAME>:1517;vclogtemplate
On the vcenter side /etc/rsyslog.conf, VMware also replaces the following line "$IncludeConfig /etc/rsyslog.d/*.conf” with "$IncludeConfig /etc/vmware-syslog/syslog.conf” and then has a ton of its own imfile monitoring in there so we also need to add that original line back right under the new one.
After adding the above configs, restart the syslog service with the below command:
service syslog restart
When I list [ ~ ] ls /etc/rsyslog.d the directory is empty. I do see the file in /etc/vmware-syslog/syslog.conf and it lists the changes I did in the VAMI.
Does anyone understand this and can help me understand it. The third-party Splunk support doesn't know VMware and is just pulling things off the internet.
Thanks