Installing VMWare Syslog

1. Sign in to your VMware vSphere Client.

2. Choose the host responsible for managing your VMware inventory.

3. Open the Configuration tab.

4. Within the Software panel, select Advanced Settings.

5. From the navigation menu, select Syslog.

6. Configure values for the following parameters:

   Parameter	ESX version	Description
   Syslog.Local.DatastorePath	ESX or ESXi 3.5.x or 4.x	Enter the directory path for the local syslog messages on your ESXi server. By default, the directory path is [] /scratch/log/messages.
   Syslog.Remote.Hostname	ESX or ESXi 3.5.x or 4.x	Enter the IP address for the Unified Security Stack agent.
   Syslog.Remote.Port	ESX or ESXi 3.5.x or 4.x	Enter the port number that the ESXi server uses for forwarding syslog data. Choose from these ports: 7002 UDP, 7002 TCP.
   Syslog.global.logHost	ESXi v5.x or ESXi v6.x	Provide the URL and port number that the ESXi server uses when forwarding syslog data. Examples: udp://<Unified Security Stack Agent IP address>:7002 tcp://<Unified Security Stack Agent IP address>:7002

7. Click OK to save the configuration

8. Sign in to your VMware ESXi Server.

9. Set up Local and Remote Logging: start an ESXi Shell console session in which the esxcli command is available, for example via the vCLI or directly on the ESXi host.

10. Display the existing five configuration options on the host by running this command:

esxcli system syslog config get

1. Set new host configuration, specifying options to change, by running a command:

esxcli system syslog config set --loghost='tcp://your_synoti_agent_ip:7002’

esxcli system syslog config set --logdir=/scratch/log --loghost=your_synoti_agent_ip --logdir-unique=true

1. After making configuration changes, load the new configuration by running this command:

esxcli system syslog reload

1. Configuring ESXi Firewall Exception using the esxcli command/syslog port

esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true

esxcli network firewall refresh

1. Run this command to test if the port is reachable from the ESXi host:

   nc -z your_synoti_agent_ip 7002

1. Enable log collector.

   To activate the log collector on the host running your Unified Security Stack agent, use the instructions below according to your operating system and chosen protocol.

   

   Run the command shown for your chosen platform

   Copy agent installation commands for each operating system directly from your Unified Security Stack instance, under the Integrations section.
   This guarantees that every token, identifier, and configuration parameter is correct and tailored to your environment.

   Example:

   

2. Click on the button shown below, to activate the Unified Security Stack features related to this integration