# Graylog ESXi Setup Help **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 2, 2018, 3:37pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420 "2018-03-02T15:37:27Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![freebird317](https://avatars.discourse-cdn.com/v4/letter/f/45deac/32.png) [@freebird317](https://community.graylog.org/u/freebird317)\ **Post date:** [March 2, 2018, 3:37pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/1 "2018-03-02T15:37:27Z")
I am not able to get ESXi and graylog to play with each other. I had them talking when I was testing graylog using the OVA. But I have since installed Ubuntu 14.07 and setup graylog following the doc on graylogs site. I am to read windows events using sidecar but nothing from ESXi. I am using vmware content pack which when applied it created an input called Logconverter Non-RFC Compliant -\> GELF on port 12204. I have setup ESXi to forward to port 1514 (firewall is opened for port). Do I need to install logstash? How do I do that if so? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [March 2, 2018, 4:55pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/3 "2018-03-02T16:55:49Z")
your issue is something complete different from the issue @freebird317 is talking off … please open a new thread if you have any problems setting up the OVA and do not capture other threads. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [March 2, 2018, 4:57pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/4 "2018-03-02T16:57:13Z")
I did not know what the content pack does - you did not provide a link to your used one. But if you have one input on port 12204 it does not make sense to forward your logs to port 1514 where nothing is listening. right? ---
**Author:** ![freebird317](https://avatars.discourse-cdn.com/v4/letter/f/45deac/32.png) [@freebird317](https://community.graylog.org/u/freebird317)\ **Post date:** [March 2, 2018, 5:18pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/5 "2018-03-02T17:18:01Z")
Just to make it simple I have removed all imputs execpt my beats for windows. This is the content pack I am using [https://marketplace.graylog.org/addons/30f5fbea-5d3f-4636-bbf1-6cd3f39941a2](https://marketplace.graylog.org/addons/30f5fbea-5d3f-4636-bbf1-6cd3f39941a2) I have “applied the content” and it created one golbal input called “Logconverter Non-RFC Compliant -\> GELF” on port 127.0.0.1:12204. I then created a GELF output on 127.0.0.1:12204. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [March 2, 2018, 5:39pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/6 "2018-03-02T17:39:43Z")
@freebird317 the content pack needs logstash running for parsing the messages into GELF - so that might be not the best choice if you did not have that running. ---
**Author:** ![freebird317](https://avatars.discourse-cdn.com/v4/letter/f/45deac/32.png) [@freebird317](https://community.graylog.org/u/freebird317)\ **Post date:** [March 2, 2018, 5:42pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/7 "2018-03-02T17:42:45Z")
What is the best way to get ESXi logs in to graylog? ---
**Author:** ![bubba198](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/bubba198/32/803_2.png) [@bubba198](https://community.graylog.org/u/bubba198)\ **Post date:** [March 2, 2018, 9:23pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/8 "2018-03-02T21:23:54Z")
Configure ESXi syslog ![sys](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/de411b54a51f49b71eb262f835584d2f6d8644d7.png) ---
**Author:** ![ysus](https://avatars.discourse-cdn.com/v4/letter/y/43a26b/32.png) [@ysus](https://community.graylog.org/u/ysus)\ **Post date:** [March 5, 2018, 4:48pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/9 "2018-03-05T16:48:10Z")
First I would suggest to move ESXi logs from /tmp/scratch to permanent storage. Then disable firewall on ESXi and see if it hepls > [root@SA-ESXI1:~] esxcli network firewall get > Default Action: DROP > Enabled: true > Loaded: true > [root@SA-ESXI1:~] esxcli network firewall set -e=false > [root@SA-ESXI1:~] esxcli network firewall refresh > [root@SA-ESXI1:~] esxcli network firewall get > Default Action: DROP > Enabled: false > Loaded: true Finally I would recommend logstash to filter out events because ESXi sends a lot of useless info > input: > > syslog { > port =\> 1514 > type =\> “esxi” > } > > filter > > if [type] == “esxi” { > > ``` > if [program] in ["Rhttpproxy","Hostd","Vpxa","vmkernel"] { drop { } } > > ``` > > } > > output: > > if [type] == “esxi” { > gelf { host =\> “127.0.0.1” port =\> 12223 } > } In this case you do not need any content packs, just create simple GELP UDP input ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 19, 2018, 4:48pm UTC](https://community.graylog.org/t/graylog-esxi-setup-help/4420/10 "2018-03-19T16:48:17Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.