The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides
VMware ESXi 5.0 host stops sending syslogs to remote server (2003127)
- An ESXi 5.0 host stops sending syslog data to a remote server.
- You have configured a remote syslog server to redirect system log files by navigating to Configuration > Software > Advanced Settings > Syslog > Syslog.global.loghost in the vSphere Client.
- The syslog service shuts down and no local and remote logging takes place.
- You see the event message:
/var/log/vobd.logfile contains an entry similar to:
[UserLevelCorrelator] 1958436204575us: [vob.user.vmsyslogd.remote.failure] The host "10.26.163.7:1514" has become unreachable. Remote logging to this host has stopped.
- The network connection has been interrupted.
- The remote host has closed the connection.
- A firewall is preventing the logs from being sent.
- The remote syslog server is not available.
To resolve this issue:
- Determine the reason(s) why the connection drops. If you are unable to determine the reason for the disconnection, inspect the
/var/log/.vmsyslogd.errfile for low-level debugging information.
- Ensure that the remote host configured in the
loghostor the vSphere Client is reachable by the ESXi host.
- Log into the ESXi host as root.
Note: The ESXi host must be configured to support SSH. For more information, see Using ESXi Shell in ESXi 5.x (2004746).
- Restore the basic connectivity between the ESXi 5.0 host and the remote syslog listener. For more information, see Configuring syslog on ESXi 5.x (2003322).
- Using the Direct Console User Interface (DCUI) or the ESXi Shell, reload the syslog server by running the command:
esxcli system syslog reload
esxcli system syslog reloadcommand returns
Failed to signal reload to vmsyslogd, then the
vmsyslogdprocess is likely not running.
- To check if the process is running, run the command:
ps |grep vmsyslogd
- If the command does not return a result, run the command:
- Run the
esxcli system syslog reloadcommand again.
Note: In ESXi 5.0, you must download a patch on the ESXi host if you are using syslog with UDP. For more information, see VMware ESXi 5.0, Patch ESXi-5.0.0-20120704001-standard (2019113).
Request a Product Feature
To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.