ESXi syslog packets departing host but failing to reach Splunk due to log level or SSL constraints

Products

• VMware vSphere ESXi

Issue/Introduction

• ESXi hosts are configured with a remote logHost (e.g., Splunk).
• pktcap-uw on the ESXi host confirms syslog packets are exiting the vmnic uplink.
• Logs do not appear in the Splunk indexer or receiver.
• The .vmsyslogd.err file may contain SSL handshake or connection reset errors.

Environment

• VMware ESXi 7.x
• VMware ESXi 8.x
• Remote Syslog Collector (Splunk)

Cause

1. Log Level Mismatch: The ESXi logLevel is set to error, preventing info or verbose logs from being transmitted even if connectivity is healthy.
2. SSL/TLS Trust: If using port 6514/TCP, the ESXi host may not trust the Splunk server's certificate.
3. Network MTU: Large log packets may be dropped by the physical network if MTU is inconsistent between the host and the collector.

Resolution

1. Verify the current syslog configuration: esxcli system syslog config get
2. Ensure the log level is set to info to capture standard operational logs: esxcli system syslog config set --log-level=info
3. Reload the syslog service to apply changes: esxcli system syslog reload
4. Test connectivity by injecting a manual log mark: esxcli system syslog mark --message="#### Connectivity Test"
5. If using secure syslog, check /var/log/.vmsyslogd.err for certificate errors.
6. If the issue persists and a defect is suspected, subscribe to this article for updates on fix status.