topic Re: Forwarding syslogs from ESX in Getting Data In

Forwarding syslogs from ESX

BlightMan — Thu, 18 Aug 2011 08:21:54 GMT

Hi! I've followed this guide to forward syslogs from ESX 4.0 U2 (http://www.splunk.com/wiki/Community:VMwareESXSyslog). But I'm not seeing logs appear on my Splunk server. What steps can I take to troubleshoot this? There's no firewall between the ESX hosts and the Splunk server. Splunk is running on a VM, but that shouldn't be a problem, I'm guessing?

Re: Forwarding syslogs from ESX

MuS — Thu, 18 Aug 2011 08:41:56 GMT

Hi BlightMan

recently I did the same, followed this doc and it worked like a charm.

regards

Re: Forwarding syslogs from ESX

BlightMan — Tue, 25 Oct 2011 15:57:11 GMT

I fixed the issue. There was a typo in the Spunk Syslog Wiki - there was an extra : on the end of one of the lines. I've updated the wiki so the command is correct.

Re: Forwarding syslogs from ESX

BlightMan — Tue, 25 Oct 2011 15:57:12 GMT

I fixed the issue. There was a typo in the Spunk Syslog Wiki - there was an extra : on the end of one of the lines. I've updated the wiki so the command is correct.

Re: Forwarding syslogs from ESX

damode — Mon, 16 Oct 2017 00:12:13 GMT

Hi @MuS,

that link takes to the splunk documentation page.

Can you please post the updated link ?

Thanks,
Deven

Re: Forwarding syslogs from ESX

damode — Mon, 16 Oct 2017 00:14:17 GMT

Hi @BlightMan,

This extra ":" you mentioned, was it under the "Set the timezone" section of that page http://wiki.splunk.com/Community:VMwareESXSyslog ?

Re: Forwarding syslogs from ESX

MuS — Mon, 16 Oct 2017 00:35:05 GMT

Link updated 😉

Re: Forwarding syslogs from ESX

damode — Mon, 16 Oct 2017 05:05:11 GMT

Thanks! @MuS

Re: Forwarding syslogs from ESX

damode — Mon, 16 Oct 2017 07:04:12 GMT

Hi @MuS,

I have to set the timezone as stated in the http://wiki.splunk.com/Community:VMwareESXSyslog doc by using below syntax,
[host::myesx.splunk.com]
TZ=UTC

if I have 8 hosts that are named such as,
cd.esx1.mail.....cd.esx6.mail and cd.svm1.mail...cd.svm3.mail

Can I use the below syntax ?
[host::cd.esx*]
TZ=UTC

[host::cd.svm*]
TZ=UTC

If not, could you please suggest me the most correct way to use the above syntax ?

Re: Forwarding syslogs from ESX

MuS — Mon, 16 Oct 2017 20:21:06 GMT

I haven't done it on host yet. Usually I use sourcetype to do such things - so I cannot not really tell if this will work or not sorry ....