Network logging to remote syslog collector stopped

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

The network logging to the remote syslog collector stopped due to a network problem. Usually, the system retries the connection to the remote collector every 3 minutes to prevent logs from being lost.

Network outages or packet drops in the network path between the ESXi host and the network collector might cause this event.

Impact

Logs might be lost during the period when the network outage occurs. The syslog daemon queues logs even when the network becomes unavailable. This bounded buffer can be filled up, and additional log messages might be dropped. Disk logging is not impacted by network outages.

Environment

VMware vCenter Server 6.5.x
VMware vSphere ESXi 6.5

Resolution

Disk logging (logging to the scratch partition) still functions. You can examine logs on the host or through the ESXi client.

Fix the network outage between the syslog collector and the ESXi host. If you find that this problem is intermittent, do nothing more network logging automatically resumes.