ESXi Syslog.global.logHost settings continuously revert to previous values due to automated API calls

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• When an attempt is made to redirect ESXi host syslog traffic(Syslog.global.logHost) to a new syslog server, the destination values are immediately overwritten, preventing accurate log forwarding.
  
  
• Diagnostic reviews of the ESXi hostd.log(/var/run/log/hostd.log) confirm rapid overwrites of the Syslog.global.logHost parameter immediately following manual administrative updates. The target ESXi host registers the configuration change triggered executing the vim.option.OptionManager.updateValues API task.

  Hostd[20###33]: [Originator@6876 sub=Vimsvc.TaskManager opID=13cb###7-f5-2##d sid=52b###87 user=vpxuser:VSPHERE.LOCAL\Administrator] Task Created : haTask-ha-host-vim.option.OptionManager.updateValues-110###1745
  Hostd[2099036]: [Originator@6876 sub=Hostsvc.SyslogConfigProvider opID=13cb###7-f5-2##d sid=52b###87 user=vpxuser:VSPHERE.LOCAL\Administrator] Set called with key 'Syslog.global.logHost', value '"udp://<Destination_IP>:514,udp://<Destination_FQDN>:514"'
  Hostd[2099036]: [Originator@6876 sub=Libs opID=13cb###7-f5-2##d sid=52b###87 user=vpxuser:VSPHERE.LOCAL\Administrator] info [ConfigStore:a23###1700] Checking for empty objects and arrays in comp esx grp syslog key global_settings object

Environment

• VMware vCenter Server 
• VMware vSphere ESXi

Cause

A legacy VMware Aria Operations for Logs cluster has the automated vSphere integration enabled. As documented in the product's architecture guidelines, when the vSphere integration is configured with the "Automatically configure all ESXi hosts" option, the appliance continuously executes automated API calls to the vCenter Server. It actively evaluates and overwrites ESXi host configurations to enforce its specific syslog settings, reverting any manual changes.

Resolution

To resolve this issue, you must halt the automated API calls originating from the legacy log cluster and then re-apply the correct syslog endpoint settings:  

1. Perform one of the following actions to stop the legacy log cluster from overwriting configurations:
   1. Power off and decommission the legacy VMware Aria Operations for Logs appliances if they are no longer in use.
   2. Alternatively, Disable  Auto-Configuration in Aria Operations for Logs following KB: Step 1: Disable Auto-Configuration in Aria Operations for Logs
2. Once the unauthorized API sessions are terminated, Apply the new destination syslog server's details:
   1. Log in to the vSphere Client.
   2. Select the target ESXi host in the inventory.
   3. Navigate to Configure > System > Advanced System Settings.
   4. Click Edit and filter for the Syslog.global.logHost key.
   5. Enter the new syslog server's details into the value field (e.g., udp://<Destination_IP>:514).
   6. Click OK to save the changes.
3. Because the rogue API calls have been halted, the vCenter Server retains the newly defined Syslog.global.logHost configurations persistently, ensuring uninterrupted log forwarding.