Logs contain unstructured data that can be analyzed in vRealize Log Insight. ESXi hosts or vCenter Server Appliance instances can push their logs to vRealize Log Insight through syslog.

You must configure the ESXi hosts or vCenter Server Appliance instances to push their syslog data to vRealize Log Insight.

A vRealize Log Insight cluster can utilize a load balancer to distribute ESXi and vCenter Server Appliance syslog feeds between the individual nodes of the cluster.

You use the Administration user interface of vRealize Log Insight to configure ESXi hosts on a registered vCenter Server to forward syslog feeds to vRealize Log Insight.


Running parallel configuration tasks might result in incorrect syslog settings on the target ESXi hosts. Verify that no other administrator user is configuring the ESXi hosts that you intent to configure.

For information on configuring syslog feeds from a vCenter Server Appliance, see Configure a vCenter Server Appliance to Forward Log Events to vRealize Log Insight.


vRealize Log Insight can receive syslog data from ESXi host versions 5.x and later.

Verify that the vCenter Server that manages the ESXi host is registered with your vRealize Log Insight instance.

Verify that you have user credentials with enough privileges to configure syslog on ESXi hosts.

Host.Configuration.Advanced settings

Host.Configuration.Security profile and firewall


You must configure the permission on the top-level folder within the vCenter Server inventory, and verify that the Propagate to children check box is selected.


Click the configuration drop-down menu icon and select Administration.


Under Integration, click vSphere.


Locate the vCenter Server instance that manages the ESXi host from which you want to receive syslog feeds.


Select the Configure ESXi hosts to send logs to Log Insight check box.

By default, vRealize Log Insight configures all reachable ESXi hosts of version 5.x and later to send their logs through UDP. ESX hosts are not supported.


(Optional) Enter the hostname or IP address of a load balancer you want to use to distribute syslog feeds.


(Optional) To select which ESXi hosts forward their logs to vRealize Log Insight, which protocol is used for forwarding logs to vRealize Log Insight, and how to handle syslog configuration on ESXi 5.x hosts, click Advanced Options.


Click Save.