ESXi syslog sending messages sent in RFC 3164 format instead of RFC 5424 format

Products

• VMware vSphere ESXi

Issue/Introduction

After configuring an ESXi host to send logging to a syslog server over TCP, the messages received by the syslog server are in the incorrect format and unable to be parsed correctly.

Example messages:
RFC 3164 Received format:  Jul 21 08:39:52 esxi01 Fdm[2108804]: ...
RFC 5424 Expected format:  2026-07-21T08:39:52.000Z esxi01 1 2026-07-21T08:39:52.000Z esxi01 Fdm 2108804 - - ...

Environment

VMware vSphere ESXi 8.x

Cause

By default, syslog messages from ESXi 8.x use RFC 3164 (BSD) formatting for remote syslog transmission and messages are limited to 1,024 bytes.
The RFC 5424 (ISO 8601) standard increased the message size to 2,048 bytes and compliance requires explicit URI parameters in the logHost configuration to enable the correct formatter and octet-based framing. 
Ultimately, formatting depends on the configured transmission protocol (UDP, TCP, or SSL).

Resolution

To change the syslog message format from RFC 3164 to RFC 5425, perform one of the following:

Update the ESXi host syslog config to include the RFC 5425 format and octet counting framing:
#> esxcli system syslog config set --loghost="tcp://<syslog_server_IP>:514?formatter=RFC_5424&framing=octet_counting"
#> esxcli system syslog reload

OR

Switch to UDP protocol:
#> esxcli system syslog config set --loghost="udp://<syslog_server_IP>:514
#> esxcli system syslog reload

To validate the change, send a test message:
#> esxcli system syslog mark --message "RFC 5424 Test Message"

Additional Information

To reset to the syslog configuration to defaults, reset the config and reload: 
#> esxcli system syslog config set --reset
#> esxcli system syslog reload

Protocols, Formats and Framing of ESXi Syslog Messages

ESXi Log File Formats introduced from vSphere ESXi 8.0

Configuring syslog on ESXi