ESXi, Vmware, logs by udp syslog

test_qweqwe — Tue, 29 Sep 2020 16:56:24 GMT

Installed addon Splunk_TA_esxilogs from https://splunkbase.splunk.com/app/3215/ and moved to /depployment-apps
Configured esxi by https://wiki.splunk.com/Community:VMwareESXSyslog so it send logs to my heavy forwarded which have open port 514.

Logs do not come. Where I missed?

Re: ESXi, Vmware, logs by udp syslog

nickhills — Thu, 23 Nov 2017 15:49:09 GMT

The VMware deployment is quite complex:
http://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfiguration

However, assuming you just want to capture the syslog, have you configured a UDP input on your heavy forwarder/indexer?
The TA wont set this up for you.

If you have, then its all the usual suspects to check next, addresses/firewalls/routes etc,

topic ESXi, Vmware, logs by udp syslog in Getting Data In

ESXi, Vmware, logs by udp syslog

Re: ESXi, Vmware, logs by udp syslog