How to stream log events from Platform and/or Collector nodes to a syslog server from VCF Operations for Networks

Products

• VCF Operations for Networks

Issue/Introduction

You may wish to stream log events from Platform and/or Collector nodes in VCF Operations for Networks to a syslog server such as VCF Operations for Logs.

NOTES:  

• VCF Operations for Networks was formerly named Aria Operations for Networks (AON), and prior to that was named vRealize Network Insight (vRNI).
• VCF Operations for Logs was formerly named vRealize Log Insight (vRLI).

Environment

VCF Operations for Networks

Resolution

The VCF Operations for Networks GUI provides the ability to configure Syslog Configuration options.

Below are the steps, but additional reference information can be found at Tech Docs - Setup Syslog Configuration

1. Log into the VCF Operations for Networks GUI
   
   
2. Select Settings --> Logs --> Syslog Configuration
   
   
3. To Enable Syslog redirection, move the button to "Enable Syslog" to the "On" position (to the right).
   
   
4. Under the "Servers" section, use the "pencil" icon to configure the following:
   1. IP Address / FQDN of the destination log repository
   2. Nickname (Optional)
   3. Port (usually 514)
   4. NOTE:  The protocol choice is only UDP 
   5. You can test whether or not the configuration is successful by clicking the "Send Test Log" button.  If successful, you will see "Success sending test log to Syslog server" in green.
      
      
5. Under the "Source - Server Mapping" section, you should see the following lines
   1. All  Platforms
   2. Alerts
   3. Audit Logs
   4. Collector Node(s)
   5. Use the "pencil" icon to the right of each line to choose the destination repository. 
   6. You can test whether or not the configuration is successful by clicking the "Send Test Log" button.  You will see "Sent Test Syslog message" in green.  The informational pop-up option encourages you to check the syslog server to confirm the test was received. 

Additional Information

To successfully take advantage of this feature, UDP information on the configured port (such as 514, in most cases) must be able to be sent along the data path from the Platform and/or Collector node(s) to the selected destination.

If that UDP information is not being received at the selected destination, engage the customer team that manages the physical network infrastructure external to the vmnic(s) on the ESXi host on which the Platform and/or Collector node(s) and/or destination syslog server are running.

If further assistance is required, please open a Support Case with Broadcom VCF Operations for Networks support using the instructions in KB 142884 - Creating and managing Broadcom cases