Configuring Alarm in vCenter for Detecting Remote Syslog disconnection from ESXi

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

By default, there is no event for syslog connectivity but you can create a vCenter Alarm based on an eventId which shows up as "esx.problem.vmsyslogd.remote.failure" in both /var/log/hostd.log as well as /var/log/vobd.log.

Symptoms:

• ESXi host is no longer able to reach a remote syslog server.
• ESXi host has connectivity issues with syslog servers.

Environment

VMware vSphere ESXi 
VMware vCenter Server

Resolution

To create a vCenter Alarm based on an eventId, follow the below steps:

Step 1 - Create a new alarm, For example "Syslog Connection Error" and you will need to specify the Alarm Type as "Host" and monitor for a specific event.

 

Step 2 - Next, click on Triggers and we will go ahead and paste in our eventId which is "esx.problem.vmsyslogd.remote.failure"

Note: Additionally SNMP traps can be configured under Actions tab.

So now when your ESXi hosts can not reach its Syslog server, you will automatically be notified and can look into the problem immediately.