How to forward other VCSA 6.5 logs to remote syslog server?

As mentioned in my previous article (which I strongly recommend you review before continuing further), the VCSA 6.5 no longer uses syslog-ng as the syslog client and it has been replaced with rsyslog. This means the instructions outlined in my old article here is no longer valid on forwarding logs from a VCSA 6.5 system to a remote syslog server. Luckily, the process to forward logs within VCSA 6.5 is also pretty straight forward using rsyslog.

Disclaimer: This is not officially supported by VMware, please use at your own risk. For very large environments, forwarding additional logs can potentially impact the vCenter Server service, so please take caution in the logs you decide on forwarding and test in a lab environment before applying this across your environment.

To help provide a concrete example, I will be using a real world scenario that often comes up from customers on auditing failed vSphere Web Client login success/failures as well as SSO user creation, deletion and password changes. The following two log files provides us with this information which we will forward to our syslog server:

• /var/log/vmware/sso/ssoAdminServer.log - Auditing SSO logins
• /var/log/vmware/sso/vmware-identity-sts.log - Auditing SSO user changes

We will be making using of rsyslog Text File Input Module (imfile) which will allow us to process local log files in the VCSA.

Step 1 - SSH to the VCSA or PSC and open the following file /etc/rsyslog.conf for editing.

Step 2 - Add following entry towards the top of the file which will load the imfile:

$ModLoad imfile

Step 3 - Add the following right below the "###### Rule declarations ######" section of the rsyslog configuration file and then save your changes.

$InputFileName /var/log/vmware/sso/ssoAdminServer.log
$InputFileTag ssoAdminServer
$InputFileStateFile ssoAdminServer

$InputFileName /var/log/vmware/sso/vmware-identity-sts.log
$InputFileTag ssoIdentitySts
$InputFileStateFile ssoIdentitySts

$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
$InputFilePollInterval 20

Using $InputFileName we specify the log file that we want to forward. The $InputFileTag is the appname that will show up when it is forwarded to your remote syslog server and $InputFileStateFile is the log monitoring file. Rather than polling every 10 seconds, I have changed $InputFilePollInterval to 20 seconds, the default is 10 if you leave it blank. You can find the complete list of imfile options and descriptions in the rsyslog documentation here.

Step 4 - Lastly, we just need to restart the rsyslog service in the VCSA for the changes to go into effect by running the following command:

systemctl restart rsyslog

If everything was configured successfully, we should start to see entries from both ssoAdminServer.log (ssoAdminServer) and vmware-identity-sts.log (ssoStsIdmd) in our syslog server.

Here is an example screenshot of my vRealize Log Insight instance showing an SSO user's password being modified which is captured as part of the ssoAdminServer.log file:

Here is an example screenshot of my vRealize Log Insight instance showing a failed SSO user login which is captured as part of the identity-sts.log file:

Something to be aware of is that some of the logs found in the VCSA may span multiple lines per entry when ingested by the remote syslog server. Below is an example of the ssoAdminServer.log which was not structured for remote syslog consumption. You may want to filter on the appname for example if you want to look for all entries in a particular log file for readability.