Sending logs via TCP from VMWare ESXi

[KPS]

Hi!

I am using your config, which is fine, but there is one problem:

When I am sending logs via TCP from VMWare ESXi, i am getting:

2022-01-14T07:00:00.192Z info hostd[2100182] [Originator@6876 sub=Vimsvc.ha-eventmgr] Event 371710 : The host "10.0.49.60:1514" has become unreachable.  Remote logging to this host has stopped.

If I point it directly to graylog, this is not the case.

What I tried:
I did setup only one upstream server to avoid, that the session can be rebalanced → No success.

Do you have any idea on how to solve this?

Thank you and best wishes
KPS

[dscryber (David Sciuto)]

NOTE: The above post was moved from nginx Config Examples as more appropriate in Daily Challenges. It reference this post:

Nginx Config Examples

For those of you who use Nginx as a reverse proxy or load balancer, you may find these configuration files useful: Here’s the example main nginx config I use for load balancing tcp/udp connections:

nginx.conf

user nginx; worker_processes 4; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $r…

[gsmith]

Hello @KPS

info hostd[2100182] [Originator@6876 sub=Vimsvc.ha-eventmgr] Event 371710 : The host "10.0.49.60:1514" has become unreachable.  Remote logging to this host has stopped.

So your remote logging host has stopped?
Did you check that host “10.0.49.60:1514” log shipper or Service is working?

[valhaim]

Hi,

have you checked the firewall on the ESXi? I’m not sure, but I think the default port for the service syslog on an ESXi is 514 and not 1514.

You could also check the receiving network traffic on your Graylog (e.g. tcpdump -lvni any port 1514 and host <ESXi IP>).