Search the VMware Knowledge Base (KB)
View by Article ID

VMware ESXi 5.x and 6.0 host stops sending syslogs to remote server (2003127)

  • 32 Ratings

Details

    • You have configured an ESXi 5.x host's syslog service to route system log streams to a remote syslog server using any of the methods described in Configuring syslog on ESXi 5.x (2003322).

    • An ESXi 5.x and 6.0 host stops sending logs to a remote syslog server.

    • You see the event message:

      esx.problem.vmsyslogd.remote.failure

    • In the /var/log/vodb.log file, you see entries similar to:

      [UserLevelCorrelator] nnnnnnnnus: [vob.user.vmsyslogd.remote.failure] The host "10.11.12.13:514" has become unreachable. Remote logging to this host has stopped.

    Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

    Solution

    This event indicates that the ESXi syslog service vmsyslogd stopped sending messages to a remote syslog server. This issue may occur if:

    • The network connection has been interrupted.
    • The remote host has closed the connection.
    • A firewall is preventing the logs from being sent.
    • The remote syslog server is not available.


    Reason for disconnection

    1. Review the log file /var/log/.vmsyslogd.err on the ESXi host to identify the timeframe and any cited reason for connection failure from the perspective of the ESXi host vmsyslogd service.

    2. Determine whether the ESXi host is correctly configured to send logs to the remote syslog server. For more information, see Configuring syslog on ESXi 5.x (2003322).

    3. Determine whether the remote syslog server logs agree with the timeframe for the connection failure. Identify any cited reason for the connection failure from the perspective of the remote syslog server.

    4. Determine whether the network connection path between the ESXi host and the remote syslog server experienced a temporary or permanent interruption.

    5. Determine whether the ESXi host logs have resumed flowing from to the remote syslog server automatically.

    Automatic Reconnection

    In some versions of vSphere ESXi, the syslog service automatically reconnects to the remote syslog server after a network interruption. It is recommended to apply one of the following patch levels to ensure persistence of logging. If updating or patching ESXi is not an option, continue with steps in the Manual Reconnection section.

    Manual Reconnection

    If the vSphere ESXi syslog service does not automatically re-establish the connection to the remote syslog server, reconnect manually.

    To reconnect manually:

    1. Open the local or remote ESXi Shell. For more information, see Using ESXi Shell in ESXi 5.x (2004746).

    2. Reload the syslog server by running the command:

      esxcli [--server hostname --user username] system syslog reload

      Note: If the esxcli system syslog reload command returns the error Failed to signal reload to vmsyslogd, then the vmsyslogd process is likely not running. Continue with steps in the Starting Service section.

    Starting the service

    If the vSphere ESXi syslog service is not running correctly or has exited, start the service.

    To start the syslog service:

    1. Open the local ESXi Shell on the affected ESXi host. For more information, see Using ESXi Shell in ESXi 5.x (2004746).

    2. Validate that the syslog service daemon vmsyslogd is not running by running the command:

      ps -Cuv | grep vmsyslogd

    3. If the command does not return a result, start the syslog service daemon by running the command:

      /usr/lib/vmware/vmsyslog/bin/vmsyslogd

    4. Load the syslog configuration by running the command:

      esxcli system syslog reload

    Additional Information

    For translated versions of this article, see:

    Request a Product Feature

    To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

    Feedback

    • 32 Ratings

    Did this article help you?
    This article resolved my issue.
    This article did not resolve my issue.
    This article helped but additional information was required to resolve my issue.

    What can we do to improve this information? (4000 or fewer characters)




    Please enter the Captcha code before clicking Submit.
    • 32 Ratings
    Actions
    KB: