How to forward vmware.log to a syslog server

Products

• VMware vSphere ESXi

Issue/Introduction

When syslog is configured on the ESXi host, only the system logs present in the scratch partition are forwarded to the syslog server.

This article explains the procedure to forward vmware.log for VMs to syslog server.

Environment

VMware vSphere ESXi 7.x 
VMware vSphere ESXi 8.x

Resolution

• Below are the steps to forward the VM logs for all the Virtual Machines of the ESXi host to syslog server. Please note, when you use the below configuration, it might be challenging to differentiate logs from different virtual machines:
  
  1. Take a backup of /etc/vmware/config file:
     cp /etc/vmware/config /var/core/vmware_config.backup

  2. Edit the file:
     vi /etc/vmware/config

  3. Add the below parameter at the end of the file:
     vmx.log.syslogID = "vmx"
  4. Save the file:
     Hit Esc -> :wq!
     
     
• The vmx.log.syslogID option allows you to tag or identify logs from a specific VM with a unique identifier when those logs are sent to the syslog server. This can be useful if you need to correlate logs from multiple VMs or differentiate logs from multiple VMs running on the same ESXi host. 
  Below are the steps to forward VM logs with a unique identifier. These edits take effect only on that virtual machine:
  
  1. Login to vSphere Client.
  2. Power off the VM.
  3. Right-click on the VM -> select Edit Settings.
  4. Select VM Options tab -> Advanced -> Configuration Parameters.
  5. Click on Edit Configuration -> Add configuration Params
  6. Add Name = vmx.log.syslogID and Value = <VM name>
  7. Save the changes.

Additional Information

https://techdocs.broadcom.com/it/it/vmware-cis/vsphere/vsphere/8-0/esxi-installation-and-setup-8-0/installing-and-setting-up-esxi-install/setting-up-esxi-install/configuring-system-logging-install/fine-tune-syslog-on-esxi-hosts-install.html