8.0

Table 4-23. Syslog Options Available Starting from ESXi 7.0 Update 1 (continued)
Option ESXCLI command Description
Syslog.global.remoteHost.maxMs
gLen
esxcli system syslog
config set --remote-host-max-
msg-len=<long>
For the TCP and SSL protocols, this
parameter specifies the maximum
length of a syslog transmission
before truncation occurs, in bytes.
The default maximum length for
remote host messages is 1 KiB.
You can increase the maximum
message length to up to 16 KiB.
However, raising this value above
1 KiB does not ensure that long
transmissions arrive untruncated to a
syslog collector. For example, when
the syslog infrastructure that issues a
message is external to ESXi.
RFC 5426 sets the maximum message
transmission length for the UDP
protocol to 480 bytes for IPV4 and
1180 bytes for IPV6.
Syslog.global.vsanBacking esxcli system syslog config
set --vsan-backing=<bool>
Allows log files and the audit record
storage directory to be placed on a
vSAN cluster. However, enabling this
parameter might cause the ESXi host
to become unresponsive.
Protocols, Formats and Framing of ESXi Syslog Messages
Starting with ESXi 8.0, the ESXi syslog daemon, vmsyslogd, uses three parameters to define how
to send messages and audit records - protocol, formatting, and framing.
The supported protocols are UDP, TCP, and TLS (SSL). Formatting of syslog messages is defined
by either RFC 3164 or RFC 5424. Framing specifies how a message is encapsulated. Framing of
encapsulated messages is defined as transparent, also called octet_counting, or non-transparent,
if a message is not encapsulated. Transparent framing ensures that new lines embedded in a
message do not confuse a syslog collector. Syslog messages sent by using the UDP protocol are
considered transparently framed; a syslog collector is expected to understand this and accept the
transmission as a single message.
RFC 3164 sets the maximum total length of a syslog message at 1024 bytes, while RFC 5424
extends this maximum to 2048 bytes.
The default maximum length for remote host messages in ESXi is 1 KiB. You can increase the
maximum message length to up to 16 KiB. However, raising this value above 1 KiB does not ensure
that long transmissions arrive untruncated to a syslog collector. For example, when the syslog
infrastructure that issues a message is external to ESXi.
Syslog messages that the vmsyslogd transmits consist of structured data, a property list formatted
in compliance with RFC 5424, and free format, or unstructured, data.
VMware ESXi Installation and Setup
VMware, Inc. 239