Install and Configure VMware syslog Collector and ESXi Dump Collector

This post is aimed at covering the VCAP-DCA objectives relating to installing the ESXi Dump Collector and the Syslog Collector. I’ve written about installing and testing the ESXi Dump Collector previously, in this post about Auto Deploy, so won’t cover it again here. This post will concentrate on the installation of the syslog collector.

ESXi Syslog Collector Installation and Configuration

The Syslog collector is part of the vCenter media, and can be installed from the vCenter Installer:

After clicking the Install button, there will be the following setup pages:

1. Click Next on the Install dialog box
2. Click Next to Accept the terms
3. On the next screen you can change the default install directory and the default log repository location. You can also set the log rotation frequency (8 logs by default) and the log size (2MB).
4. On the next screen you can choose whether to integrate the syslog collector with vCenter or have it as standalone.
5. On the next screen, for a vCenter integrated installation, you will be prompted for vCenter IP address and credentials.
6. Click Next. Here you can change the ports that the syslog server will use, or leave it as the defaults.
7. On the identification screen, choose the IP or name for how the server will be identified.
8. On the next screen, click Install. Once the installation is complete, click Finish.

Once installed, when using vCenter integration, you will have a new administration plugin in vCenter:

Clicking on the icon will show you information on the collector and the hosts that are configured to use it:

Change VMware Syslog Collector Settings

If you need to change the syslog collector settings after install you can do so by editing the ‘%PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml‘ file. It’s strongly recommended that you take a backup of the file before making any changes.
The contents of the .xml file will resemble the following example:

After making any changes to this file, for them to take effect, it is recommended to restart the Syslog service:

C:\>sc stop VMware-Syslog-Collector

SERVICE_NAME: VMware-Syslog-Collector
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 3  STOP_PENDING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x1
        WAIT_HINT          : 0x1388

C:\>sc start VMware-Syslog-Collector

SERVICE_NAME: VMware-Syslog-Collector
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 6000
        FLAGS              :