Remote Event Streaming for vCenter Server is experiencing issues, resulting in events not being transmitted to the designated remote syslog server.

Products

• VMware vCenter Server

Issue/Introduction

The Forwarding configuration for remote syslog in the VAMI showing the connection status is "Unknown"

The advanced configuration required to enable event streaming to the remote syslog server is correctly set: vpxd.event.syslog.enabled = TRUE

Clicking ’send test message’ produces a successful result:

Environment

VMware vCenter Server 8.x

Cause

The Appliance Management log file on the vCenter Server indicates that the connection attempt to the remote syslog server is being refused. You may observe log entries similar to the following.

/var/log/vmware/applmgmt/applmgmt.log:

YYYY-MM-DDTHH:MM:SS [####]DEBUG:vmware.appliance.syslog.syslog_lib:Making IPv4 connection to host=<remote server IP or FQDN>
YYYY-MM-DDTHH:MM:SS [####]ERROR:vmware.appliance.syslog.syslog_lib:Error executing /usr/sbin/ip for ip4 : [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionRefusedError'>: Connection was refused by other side: 111: Connection refused.]
YYYY-MM-DDTHH:MM:SS [####]DEBUG:vmware.appliance.syslog.syslog_lib:TCP connection results = [(False, <twisted.python.failure.Failure twisted.internet.error.ConnectionRefusedError: Connection was refused by other side: 111: Connection refused.>), (True, None)]

Resolution

• Review the configuration of the remote syslog server to verify its accuracy.
• Performing packet captures on the remote server may help identify potential upstream network or configuration issues.

Additional Information

vCenter not sending log entries when configured syslog servers to use mixed protocols with TLS.