After restarting the Log Insight service, syslog messages from ESXi hosts stop arriving in Log Insight.

Configuration changes in Log Insight require that you restart the Log Insight service. After the restart, syslog feeds from ESXi are no longer available.

Certain versions of ESXi stop sending logs if the connectivity to the remote syslog listener is interrupted, even briefly. This problem affects the following ESXi versions, depending on the communication protocol that is used.

ESXi Versions That Stop Sending Syslog Messages

Communication Protocol

Affected ESXi Version

TCP

ESXi 5.0.x

ESXi 5.1.x

UDP

ESXi 5.0 and 5.0 Update 1

Important

The issue is fixed in ESXi 5.1 Update 2 and ESXi 5.0, Patch ESXi500-201401401-BG. VMware recommends that you apply the update or patch to be sure that your ESXi hosts do not stop sending syslog messages to their remote destinations. For more information see https://www.vmware.com/support/vsphere5/doc/vsphere-esxi-51u2-release-notes.html and VMware ESXi 5.0, Patch ESXi500-201401401-BG: Updates esx-base (2065691). If you do not wish to apply the update or patch, use the following solution.

1

Click the configuration drop-down menu icon and select Administration.

2

Under Integration, click vSphere.

3

For each vCenter Server instance that has the View ESXi syslog configuration details link, click the View ESXi syslog configuration details link.

4

Select all hosts that previously had a configuration and click Configure.

Note

The configuration process can take several minutes. You must repeat the procedure every time you restart Log Insight. For details about syslog problems and solutions, see VMware ESXi 5.x host stops sending syslogs to remote server (2003127).