vCenter Server syslog messages are not received by the remote Syslog server over UDP port 514

Products

• VMware vCenter Server 8.0

Issue/Introduction

• The syslog server IP and UDP port 514 are configured accurately in the vCenter Server Appliance Management Interface (VAMI).
• ICMP pings from the vCenter Server to the syslog server are successful, and port connectivity test on port 514 succeeds.
• Sending a test text message from the VAMI reports success.

Environment

VMware vCenter Server

Cause

• Packet captures performed on the ESXi host where the vCenter Server virtual machine resides confirm that syslog packets on UDP port 514 are successfully leaving the host.
• Since the packets are egressing the host correctly, the packets are being dropped in transit on the network or rejected at the destination syslog server.

 

Resolution

• Engage the network administration team to trace the traffic path between the vCenter Server and the remote syslog server.
• Review the destination syslog server configuration to ensure it is actively listening and permitted to UDP 514 traffic specifically from the vCenter Server IP address.