Collecting VMWare/VCSA-Logs - Best practice

[KPS]

Hi!

I am trying to collect VMWare-Logs with graylog 4.2.5
→ Created TCP-Syslog-Input
→ Tried Content-Pack from marketplace:

Graylog

But: There is still a lot open.

According to Multiline/Fragmented Rsyslog Events - #5 by frantz - VMWare is sending multi-line-logs which are not handled, currently. So, there are logs, that do only contain: “–>”.

The dashboard of the contant-pack is empty, too.

Are you sending VMWare-logs to graylog? What is your concept? Do you need Logstash as “proxy”, or what are you using?

Thank you and best wishes.
KPS

[KPS]

One update: Syslog-Input is discarding most of the vmware-logs. RAW-input is able to show a lot more…

[gsmith]

Hello,

@KPS

According to Multiline/Fragmented Rsyslog Events - #5 by frantz - VMWare is sending multi-line-logs which are not handled, currently.

You may want to look at this for multiline logs.

Manage multiline messages | Filebeat Reference [7.10] | Elastic

I also found these …

Multiline Log issue with rsyslog

Best practice to store the System Logs for all of the newly upgraded ESXi...

VMWare host syslog

Hi, i just configure graylog appliance for vmware,all went perfect i also configure my ESXI 6 hosts to send logs to the greylog server by using the following input udp://:514 still dont receive any logs to graylog help ? I have tried several different inputs such as syslog udp on port 1514 (using ip tables to forward traffic destined for tcp/udp port 514 to 1514) I have also done the same using port 12207 i have also tried a plain text gelf udp in the same config iptable comman…

https://www.reddit.com/r/vmware/comments/elkmcz/help_configuring_vcsa_and_syslog_graylog/

Last thing I did find was under Collectors

I hope all this information will help.