Getting Data In

Can I get Splunk to collect logs from vCenter's ESXi Dump Collector?

FhaySpl1
New Member

My vCenter guys are looking to install the ESXi Dump Collector so that they can store months worth of ESX log and metric data for their own troubleshooting. I don't already have a Syslog Collector to tap into the ESXi logs. I would like to tap into the ESXi Dump Collector and ingest those logs into Splunk

Tags (1)
0 Karma

FhaySpl1
New Member

Thank you, Iguinn. This makes practical sense. As a result, I have asked our vCenter team to consider the installation of a UF on the collection disk.

0 Karma

lguinn2
Legend

It is my understanding that the dump collector "transmits diagnostic information to a remote netdump service, which stores it on disk," to paraphrase a VMware KB article. The netdump service saves the diagnostics in the "zdump" format. It's been a few years since I did ESXi administration, so I have no idea what the file format really is.

But here is the thing. If the dump collector runs on Windows or Linux, and writes its file in some text format on a local disk => then you can install the Splunk Universal Forwarder (UF) on that server and collect the files from disk and send it to Splunk. So just find out where the vCenter guys are going to store the months of data, and collect it from there. Your UF will only need to run with sufficient privileges to read the files.

Although I expect it is possible for Splunk to monitor the ESXi Dump Collector service directly, I would not want to do that - partly because it might interfere with what the vCenter guys want to do. But mostly because it will be easier to pick up the logs files after they have already done the collection for you.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...