I had a couple folks ping me recently asking whether the latest vCenter Server Appliance (VCSA) 6.5 release supports forwarding to multiple syslog targets? Currently today, only a single syslog target is officially supported which can be configured using the VAMI UI. I know this is something our customers have been asking about and I know this is something the VC Engineering team is considering.
Having said that, it is possible to configure additional syslog targets on the VCSA, but please be aware this is not officially supported. A couple of these customers understood the support impact and were still interested in a solution as some of their environments mandated multiple redundant syslog targets and using a syslog forwarder/relay was not an option for them.
Disclaimer: This is not officially supported by VMware, please use at your own risk.
When configuring syslog forwarding from the VAMI UI, the configurations are all written to /etc/vmware-syslog/syslog.conf on the VCSA.
With this information, if we want to add additional targets (which can be of the same configuration or different), you simply append additional targets to the syslog configuration file. For example, if I have two syslog targets 192.168.30.110 and 192.168.30.111 and I wish to use the default log level, TCP and 514, I would use the following:
*.* @@192.168.30.110:514;RSYSLOG_SyslogProtocol23Format *.* @@192.168.30.111:514;RSYSLOG_SyslogProtocol23Format
Once you have saved your changes, you will need to restart the rsyslog service for the change to go into effect. To do so, run the following two commands on the VCSA:
systemctl stop rsyslog
systemctl start rsyslog
One additional thing to note is that the VAMI UI will only show the very last syslog target within the configuration file but if you monitor syslog servers, you will see that logs are indeed being forward to all servers that have been configured in the syslog configuration file.
Hi William,
that's good to know, thanks for sharing!
I was asking myself the same question about NSX Manager.
Is it also possible to define multiple syslog targets? In the UI, there's only one syslog target which can be set.
And is it also not officially supported if you define multiple syslog servers?
btw: Your blog is absolutely fantastic! If you have a VMware question, William has it covered, for sure!
regards,
Ronny
To make this official and supported by VMware possibly allow atleast 3x sysylog configs, to be configurable via VAMI UI.