Sending Your VMWare vSphere Logs to LogDNA

In this post, we'll show you how to centralize logs from VMWare vSphere by sending them LogDNA. We'll explain how to configure your ESXi hosts and vCenter Server Appliance to ensure that your vSphere infrastructure is fully logged.

Logging your virtual machines (VMs) is important, but what's even more important is logging the hypervisors that run them. Hypervisors generate extremely useful data about the operation of your virtual machines and the environments that they run in. While VMs provide some information about their state, details such as VM performance, changes in state, errors, and security can only be found through hypervisor logs.

The challenge is retrieving and using these logs. Logging a VM is as simple as installing a logging agent, but hypervisors (specifically bare metal hypervisors) often have much more limited operating environments. Installing third-party software on a hypervisor may be much more difficult (if at all possible) than a desktop or server OS. However, this doesn't make hypervisor logging impossible; in fact, it may be easier than you would expect.

Why You Should Log VMWare vSphere

VMWare vSphere is a suite of applications and services for administering VMs. It is made up of two main components:

• ESXi, the bare metal hypervisor that runs VMs.
• vCenter Server, an application for managing ESXi hosts and VM instances. vCenter Server is most commonly deployed as a preconfigured VM called the vCenter Server Appliance (vCSA).

ESXi hosts log all VM activity including startups and shutdowns, warnings and errors, hardware changes, and migrations. They also record host activities such as kernel events, security events (e.g. user logins), shell commands, and communications with vCenter Server. Each host runs a local syslog service, which writes all logs to the local filesystem.

vCSA logs activities related to the management and administration of vSphere and ESXi hosts. This includes connections from vSphere Clients, profile metrics for various vSphere operations, and performance and health data from ESXi hosts. Like ESXi, the vCSA uses a syslog service to record all logs to the local filesystem.

Logging your vCSA and ESXi hosts gives you a complete overview of any and all activities that took place in your vSphere infrastructure. Using a log management system like LogDNA lets you centralize, analyze, and monitor these logs to ensure your vSphere infrastructure is running smoothly. This includes monitoring for new VM instances and VM failures, poor performance, problems with your ESXi hosts, security incidents and failed logins, and much more. These logs can also help system administrators and DevOps engineers troubleshoot infrastructure problems by providing detailed contextual information about events that occurred and the systems they impacted.

Sending vSphere Logs to LogDNA

Since ESXi and vCSA route all logs through syslog, forwarding their logs to LogDNA is as easy as appending a URL to the syslog service configuration. Before configuring your vSphere services, follow the instructions for adding a syslog host to LogDNA. After you generate a syslog URL and port, keep the window open since you will need to copy this URL to your ESXi and vCSA configurations.

ESXi

The ESXi syslog service is called vmsyslogd. By default, this service writes all logs to a set of log files on the local filesystem. By making a minor change to the vmsyslogd configuration, we can route these logs to LogDNA.

As an alternative, you can forward your ESXi logs to your vCSA or a dedicated log server before forwarding them to LogDNA. This lets you centralize your ESXi logs without exposing your hosts to the public Internet. The process is the same as sending your Logs to LogDNA, only the URL you provide will be the URL to your log server.

There are multiple ways to configure syslog on your ESXi hosts including using a vSphere Client, Host Profiles, or the esxcli CLI utility. We'll show you how to configure a host using esxcli.
After opening a console session on your ESXi host, run esxcli system syslog config set with the loghost option set to your LogDNA URL:

esxcli system syslog config set --loghost='syslog-x.logdna.com:12345'

This command uses the UDP protocol, but you can specify TCP or TCP+TLS instead:

esxcli system syslog config set --loghost='tcp://syslog-x.logdna.com:12345'

Reload the syslog daemon to apply the changes:

esxcli system syslog reload

For more information about configuring ESXi, visit the Configuring syslog on ESXi knowledge base article.

vCSA

vCSA also runs a local syslog service, which you can configure using the vCenter Server Appliance Management Interface. Start by logging into the management interface and selecting Syslog Configuration. Click Edit, then select the log files that you wish to forward from the Common Log Level drop-down menu. Clicking * will redirect all log files.

Use the Remote Syslog Host, Remote Syslog Port, and Remote Syslog Protocol boxes to enter your LogDNA syslog endpoint. Click OK to apply the changes and send your vCSA logs to LogDNA.

For more information about configuring vCSA, visit the Redirect vCenter Server Appliance Log Files to Another Machine documentation page.

Conclusion

Forwarding your vSphere logs to LogDNA is one of the easiest and fastest ways to monitor, troubleshoot, and audit your VM deployments. From here, you can use LogDNA's custom log parser, graphs, alerts, and other features to put your logs to greater use. To get started, sign into your LogDNA account and follow the instructions for setting up a syslog URL.

To learn more about LogDNA, contact us, visit our website, or sign up for a 14-day free trial (no credit card required).