Knowledge Base

The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides
 
Search the VMware Knowledge Base (KB)   View by Article ID
 

VMware ESXi 5.0 host stops sending syslogs to remote server (2003127)

Details

  • An ESXi 5.0 host stops sending syslog data to a remote server.
  • You have configured a remote syslog server to redirect system log files by navigating to Configuration > Software > Advanced Settings > Syslog > Syslog.global.loghost in the vSphere Client.
  • The syslog service shuts down and no local and remote logging takes place.
  • You see the event message:

    esx.problem.vmsyslogd.remote.failure

  • The /var/log/vobd.log file contains an entry similar to:

    [UserLevelCorrelator] 1958436204575us: [vob.user.vmsyslogd.remote.failure] The host "10.26.163.7:1514" has become unreachable. Remote logging to this host has stopped.

Solution

This issue may occur if:
  • The network connection has been interrupted.
  • The remote host has closed the connection.
  • A firewall is preventing the logs from being sent.
  • The remote syslog server is not available.

To resolve this issue:

  1. Determine the reason(s) why the connection drops. If you are unable to determine the reason for the disconnection, inspect the /var/log/.vmsyslogd.err file for low-level debugging information.
  2. Ensure that the remote host configured in the /etc/vmsyslog.conf file using loghost or the vSphere Client is reachable by the ESXi host.
  3. Log into the ESXi host as root.

    Note: The ESXi host must be configured to support SSH. For more information, see Using ESXi Shell in ESXi 5.x (2004746).

  4. Restore the basic connectivity between the ESXi 5.0 host and the remote syslog listener. For more information, see Configuring syslog on ESXi 5.x (2003322).
  5. Using the Direct Console User Interface (DCUI) or the ESXi Shell, reload the syslog server by running the command:

    esxcli system syslog reload

    If the esxcli system syslog reload command returns Failed to signal reload to vmsyslogd, then the vmsyslogd process is likely not running.

  6. To check if the process is running, run the command:

    ps |grep vmsyslogd

  7. If the command does not return a result, run the command:

    /usr/lib/vmware/vmsyslog/bin/vmsyslogd

  8. Run the esxcli system syslog reload command again.

Note: In ESXi 5.0, you must download a patch on the ESXi host if you are using syslog with UDP. For more information, see VMware ESXi 5.0, Patch ESXi-5.0.0-20120704001-standard (2019113).

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 13 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (4000 or fewer characters)
  • 13 Ratings
Actions
KB: