6.5.1

Streaming Events to a Remote Syslog Server
You can stream to a remote syslog server the information about the events that your vSphere system
generates. Streaming events is supported only for the vCenter Server Appliance.
The streaming of events to a remote syslog server is disabled by default. You can enable and congure the
streaming of vCenter Server events to a remote syslog server from the vCenter Server Appliance
Management Interface. After you enable remote streaming, vCenter Server Appliance starts streaming and
only the newly generated events are streamed to the remote syslog server.
All syslog messages begin with a specic prex. You can distinguish the vCenter Server Appliance events
from other syslog messages by their Event prex.
The syslog protocol limits the length of syslog messages to 1024 characters. Messages that are longer than
1024 characters split into multiple syslog messages.
In the syslog server, events have the following format:
<syslog-prefix> : Event [eventId] [partInfo] [createdTime] [eventType] [severity] [user]
[target] [chainId] [desc]
Item Description
syslog-prex
Displays the syslog prex. The <syslog-prefix> is determined by the remote syslog
server conguration.
eventId Displays the unique ID of the event message. The default value is Event.
partInfo Displays whether the message is split into parts.
createdTime Displays the time when the event was generated.
eventType Displays the event type.
severity Displays whether the event is a piece information, a warning, or an error.
user Displays the name of the user who generated the event.
target Displays the object the event refers to.
chainId Displays information about the parent or the group ID.
desc Displays the description of the event.
Example: Split of Long Event Message into Multiple Syslog Messages
Events that are longer than 1024 characters split into multiple syslog messages in the following manner:
<syslog-prefix> : Event [eventId] [1-X] [payload-part-1]
<syslog-prefix> : Event [eventId] [2-X] [payload-part-2]
...
<syslog-prefix> : Event [eventId] [X-X] [payload-part-X]
The X stands for the number of the event message parts.
Redirect vCenter Server Appliance Log Files to Another Machine
You can redirect the vCenter Server Appliance log les to another machine, for example, if you want to
preserve storage space on the vCenter Server Appliance.
Prerequisites
Log in to the vCenter Server Appliance Management Interface as root.
vSphere Monitoring and Performance
106 VMware, Inc.