Collecting VMWare/VCSA-Logs - Best practice

[gsmith]

Hello,

@KPS

According to Multiline/Fragmented Rsyslog Events - #5 by frantz - VMWare is sending multi-line-logs which are not handled, currently.

You may want to look at this for multiline logs.

Manage multiline messages | Filebeat Reference [7.10] | Elastic

I also found these …

Multiline Log issue with rsyslog

Best practice to store the System Logs for all of the newly upgraded ESXi...

VMWare host syslog

Hi, i just configure graylog appliance for vmware,all went perfect i also configure my ESXI 6 hosts to send logs to the greylog server by using the following input udp://:514 still dont receive any logs to graylog help ? I have tried several different inputs such as syslog udp on port 1514 (using ip tables to forward traffic destined for tcp/udp port 514 to 1514) I have also done the same using port 12207 i have also tried a plain text gelf udp in the same config iptable comman…

https://www.reddit.com/r/vmware/comments/elkmcz/help_configuring_vcsa_and_syslog_graylog/

Last thing I did find was under Collectors

I hope all this information will help.