Syslog messages being lost between host and syslog server "vmsyslog logger lost #### log messages"

Products

• VMware vSphere ESXi

Issue/Introduction

An ESXi host or vCenter Server triggers a Host error alarm. The following event description is recorded in the logs or the vCenter interface:
Issue detected on <HOST> in <DOMAIN> vmsyslog logger <SYSLOG_SERVER>:514 lost #### log messages

Environment

• VMware ESXi 9.0 
• VMware ESXi 8.0 

Cause

The hosts and vCenter do not have network connectivity to the syslog server. 

Resolution

Verify and restore network connectivity between the source host and the destination syslog server.

1. Test Network Connectivity
   1. From the ESXi shell or vCenter Server appliance (VCSA) command line, test whether the syslog port is reachable on the remote server.
   2. Review this command before running it.
      • nc -zv <SYSLOG_SERVER_IP> 514
2. Remediate Network Blocks
   • If the connectivity test fails:
     1. Ensure that TCP/UDP port 514 (or the custom configured port) is open on all physical firewalls and network path devices between the ESXi management network and the syslog server network.
     2. Confirm the syslog service on the destination server is active and configured to accept logs from the host's IP address.
     3. Verify that any intermediate load balancers are correctly routing syslog traffic.

Additional Information

 Troubleshooting "vmsyslog logger lost #### log messages" on ESXi hosts

ESXiホストと Syslog サーバー間で Syslog メッセージが失われています「vmsyslog logger lost #### log messages」