ESXi 8.0U3 hosts fail to forward logs to syslog

Products

• VMware vSphere ESXi

Issue/Introduction

This article describes an issue where VMware vSphere ESXi hosts fail to forward logs to a remote syslog server

Symptoms:

• Syslog server is not receiving logs from a subset of ESXi hosts.
• System logs indicate DNS resolution failures when attempting to resolve the FQDN of the syslog server.
• Errors observed in vmsyslog.loggers.network include: getaddrinfo: host <syslog_server_fqdn> port 514: [Errno -3] Temporary failure in name resolution failed to establish connection to remote syslog server <syslog_server_fqdn>:514

Environment

VMware vSphere ESX

Cause

The issue is primarily caused by a failure in DNS name resolution on the affected ESX hosts. This can stem from two root scenarios:

• Firewall Misconfiguration: Firewall rules on the network or the ESXi host (vmk0) are preventing the necessary traffic (ICMP/DNS) between the ESX host and the DNS server.
• DNS Infrastructure Configuration: The DNS servers are not correctly configured to resolve the specific FQDN required by the ESXi host, or the ESX host is unable to reach the configured DNS server IP.

 

Resolution

To resolve this issue, ensure the ESXi host has functional connectivity to the DNS servers and that the DNS records are correctly configured.

1. Verify DNS Connectivity: Verify the ESXi host can reach the configured DNS servers (e.g., via ping or nslookup if available in your version).

2. Check Firewall Rules: Ensure that network-level firewall rules allow traffic from the ESXi management interface (vmk0) to the DNS server IP addresses.

   • Confirm that DNS (typically UDP/TCP port 53) traffic is permitted in both directions.
   • If using the ESXi internal firewall, you can temporarily test connectivity by disabling it to isolate the issue:
     esxcli network firewall set --enabled false
   • Note: Remember to re-enable the firewall after testing:
     esxcli network firewall set --enabled true

3. Validate DNS Records: Work with your network administrator to verify that the DNS A or CNAME records for the syslog server FQDN are correctly configured and resolvable by the network segment where the ESXi hosts reside.

Additional Information

Configuring syslog on ESXi