Modifying the VMware Syslog Collector settings after it is installed

Products

• VMware vCenter Server

Issue/Introduction

This article provide steps to modify the VMware Syslog Collector configuration after it is installed.

Note: During installation of the VMware Syslog Collector product, various attributes can be configured (for example, the ports on which syslog connections are made, the protocols supported (TCP/UDP), the number of log files retained per host, and the size of each log file before it is rotated). You cannot change any of these settings in the vSphere Client.

Environment

VMware vCenter Server 5.5.x
VMware vCenter Server 6.0.x

Resolution

To modify the VMware Syslog Collector configuration after it is installed:

1. Backup the file:
   
   vCenter Server 5.5 and lower: %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml
   vCenter Server 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
    
2. Open the copied file using a text editor.
3. Under <defaultValues>, update options to the required values.
   
   For example, to increase the log file size to 10 MB and to decrease the number of files retained to 20, modify the attributes:
   
   <defaultValues>

<port>514</port>

<protocol>TCP,UDP</protocol>

<maxSize>10</maxSize>

<rotate>20</rotate>

<sslPort>1514</sslPort>

</defaultValues>

Note: This configuration in vCenter Server overrides the ESXi host configuration file.

4. Save and close the file.
5. Stop the VMware Syslog Collector service.
6. Remove the file:
   
   vCenter Server 5.5 and lower: %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml
   vCenter Server 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
    
7. Rename the modified file to:
   
   vCenter Server 5.5 and lower: %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml
   vCenter Server 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
    
8. Start the VMware Syslog Collector service. You must restart the syslog service on the ESXi host if logs are no longer updating on the Syslog Server. To restart the syslog service, see VMware ESXi 5.x host stops sending syslogs to remote server (2003127).

Notes:

• If the <port>, <protocol> or <sslport> values are changed, any hosts using the syslog collector will need to have their configuration updated appropriately. For more information, see Configuring syslog in ESXi 5.0 and 6.0 (2003322).
• <maxSize> is the maximum file size allowed.
• <rotate> is the number of files to retain.
• Changing the <maxSize> or <rotate> values will not have any effect on existing log files.
• The recommended maximum ESXi hosts is 30 for the syslog collector.