# Collecting VMWare/VCSA-Logs - Best practice

**URL:** <https://community.graylog.org/t/collecting-vmware-vcsa-logs-best-practice/22335>\
**Category:** Graylog Central (peer support)\
**Created:** [January 14, 2022, 7:34am UTC](https://community.graylog.org/t/collecting-vmware-vcsa-logs-best-practice/22335 "2022-01-14T07:34:10Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [January 15, 2022, 2:33am UTC](https://community.graylog.org/t/collecting-vmware-vcsa-logs-best-practice/22335/3 "2022-01-15T02:33:11Z")

</div>

Hello,

> [@KPS](#):
>
> According to [Multiline/Fragmented Rsyslog Events - #5 by frantz](https://community.graylog.org/t/multiline-fragmented-rsyslog-events/10159/5) - VMWare is sending multi-line-logs which are not handled, currently.

You may want to look at this for multiline logs.

> **[Manage multiline messages | Filebeat Reference \[7.10\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.10/multiline-examples.html)**

I also found these …

> <https://stackoverflow.com/questions/33184234/multiline-log-issue-with-rsyslog>

> **[Best practice to store the System Logs for all of the newly upgraded ESXi...](https://communities.vmware.com/t5/vSphere-Upgrade-Install/Best-practice-to-store-the-System-Logs-for-all-of-the-newly/td-p/2145341)**
>
> Hi People, What are the options and best practice for the System Logs for all of the newly upgraded ESXi 5.1u1 hosts ? Do I need to have Syslog server or this can be ignored safely ? Thanks

> [@VMWare host syslog](https://community.graylog.org/t/vmware-host-syslog/9509):
>
> Hi, i just configure graylog appliance for vmware,all went perfect i also configure my ESXI 6 hosts to send logs to the greylog server by using the following input udp://:514 still dont receive any logs to graylog help ? frowning I have tried several different inputs such as syslog udp on port 1514 (using ip tables to forward traffic destined for tcp/udp port 514 to 1514) I have also done the same using port 12207 i have also tried a plain text gelf udp in the same config iptable comman…

[https://www.reddit.com/r/vmware/comments/elkmcz/help\_configuring\_vcsa\_and\_syslog\_graylog/](https://www.reddit.com/r/vmware/comments/elkmcz/help_configuring_vcsa_and_syslog_graylog/)

Last thing I did find was under Collectors

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c18b9a02bb47b6e831f2c19f0f77959dd400210a.png)

I hope all this information will help.

---

_[View the full topic](https://community.graylog.org/t/collecting-vmware-vcsa-logs-best-practice/22335)._