vCenter not sending log entries when configured syslog servers to use mixed protocols with TLS.

Products

• VMware vSphere ESXi

Issue/Introduction

Configuring vCenter Server Appliance to send logs to different syslog servers each destination with different protocols configuration (TLS, TCP and UDP).

 

• When using vCenter 8.0, for some time the log messages may arrive to the syslog servers configured for TLS but eventually those messages will also stop to be sent.
• vCenter 7.0 will immediately stop to send the log messages to all syslog servers.
• No error messages will show on vCenter.
• The syslog server defined as TCP will receive encrypted messages and will refuse the connection.
  

 

Environment

vCenter Server Appliance all versions.

Cause

This happens because once vCenter is defined to use TLS for any syslog server, it will encrypt all messages to be sent using that protocol.

 

Resolution

It is not supported to configure mixed versions of protocols for syslog servers along with TLS.

• Make sure all syslog servers are defined to use the TLS or all of them use TCP/UDP.
  
  
  
• If TLS is a requirement but a destination syslog server doesn't support it, remove that server from the configuration.
  
  
  
  
• It is supported to have mixed TCP and UDP protocols.