VMware ESXi host stops sending syslogs to remote server.

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

Introduction:

Syslog functionality enables the forwarding of system logs from ESXi hosts to a remote server. Connectivity failures typically result from vmsyslogdservice interruptions or restricted network access. This article focuses on identifying whether the issue stems from the syslog daemon, firewall configuration, or intermediate network pathing.

Symptoms:

• • ESXi host stops forwarding logs to a remote syslog server.
  • The following event message is observed: esx.problem.vmsyslogd.remote.failure
  • In /var/log/vobd.log, entries similar to the following exist: [UserLevelCorrelator] ####us: [vob.user.vmsyslogd.remote.failure] The host "####:514" has become unreachable. Remote logging to this host has stopped.

Environment

• VMware vSphere ESXi 7.x, 8.x, 9.x
• VMware vCenter Server 7.x, 8.x, 9.x

Cause

This issue occurs if:

• Network connection is interrupted.
• Remote host closed the connection abruptly.
• A firewall is blocking the port used for syslog service communication.
• The remote syslog server is offline.

Resolution

Section 1: Reason for Disconnection

1. Review /var/log/.vmsyslogd.err to identify the timeframe and failure reason from the perspective of the vmsyslogd service.
2. Verify the ESXi host configuration for remote syslog forwarding. 

   esxcli system syslog config get

3. Validate the syslog ruleset is enabled under Host > Configure > System > Firewall for all host.

   esxcli network firewall ruleset get 

4. Check remote syslog server logs to correlate the timeframe of the connection failure.
5. Investigate the network path for temporary or permanent interruptions. 

   TCP: nc -zv <remoteserver_IP> 514
   UDP: nc -zuv <remoteserver_IP> 514

6. Determine if logs resumed flowing to the remote server automatically.

Section 2: Manual Reconnection If the syslog service does not automatically re-establish the connection, reconnect manually:

1. Establish an SSH session to the ESXi host.
2. Reload the syslog service: esxcli system syslog reload
   • Note: If this command returns Failed to signal reload to vmsyslogd, the process is not running. Proceed to Section 3.

Section 3: Starting the Service If the syslog service is stopped or has exited, restart it:

1. Establish an SSH session to the affected ESXi host.
2. Verify the vmsyslogd daemon status: ps -Cuv | grep vmsyslogd
3. If no result is returned, start the service: /etc/init.d/vmsyslogd start
4. Reload the syslog configuration: esxcli system syslog reload

Additional Information

VMware ESXi ホストからリモートサーバーへの Syslog 送信が停止する