ESXI not forwarding logs to syslog

Products

• VMware vCenter Server

Issue/Introduction

You configured ESXi to forward logs to syslog following Configuring syslog on ESXi but no logs are received on targeted server.

 

Checking error logs  .vmsyslogd.err located in /var/log you see similar messages 

 

vmsyslog.loggers.network : ERROR   ] SSL certificate verification failed: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1016)
vmsyslog.loggers.network : ERROR   ] SSL certificate verification failed: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1016)
vmsyslog.loggers.network : ERROR   ] failed to establish connection to remote syslog server 'FQDN of targetserver':23514

 

 

Environment

ESXI 7.x

ESXI 8.x

Cause

Syslog server is not trusting ESXI certificate

Resolution

Publish root signing certificate to remote syslog server.

 

If you using VMCA certificate you can download certificate following Download and install vCenter Server root certificates to avoid web browser certificate warnings

 

Or you can use this commands to get root certificate 

 

To check what is signing certificate if  ESXi chekc following file (in this example vCenter is owner of root certficate)
 
/etc/vmware/ssl/rui.crt 
 

You see that ESXi certificates are signed by vCenter root certificate
 
You note Authority Key Identifier in rui.crt from signing certificate 
 
 
 X509v3 Authority Key Identifier:
                AA:BB:CC:DD:EE:FF:GG:AA:BB:CC:DD:EE:FF:GG:AA:BB:CC:DD:EE
 
 
Then open SSH to vCenter and run this command  
 
/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store TRUSTED_ROOTS --text | less
 
Then identified alias of certificate with same Authority Key Identifier and use this command to export that to crt file 
 
/usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store TRUSTED_ROOTS --alias AAAA#######AAAAA######AAAAA#### --output /tmp/trustedroot.crt
 
 
 
Then you will need to present that certificate syslog server.