You can configure a vCenter Server Appliance to send its log messages to vRealize Log Insight trough syslog.

To configure ESXi hosts to forward their logs to vRealize Log Insight, see Connect Log Insight to vCenter Server Systems.

Verify that you have the root user credentials for the vCenter Server Appliance.

If you plan to connect to the vRealize Log Insight virtual appliance by using SSH, verify that TCP port 22 is open.


Establish an SSH connection to the vCenter Server Appliance host and log in as the root user.


Navigate to /etc/syslog-ng/.


Open the syslog-ng.conf file for editing and add the following text at the end of the file.

source vpxd {
file("/var/log/vmware/vpx/vpxd.log" follow_freq(1) flags(no-parse));
file("/var/log/vmware/vpx/vpxd-alert.log" follow_freq(1) flags(no-parse));
file("/var/log/vmware/vpx/vws.log" follow_freq(1) flags(no-parse));
file("/var/log/vmware/vpx/vmware-vpxd.log" follow_freq(1) flags(no-parse));
file("/var/log/vmware/vpx/inventoryservice/ds.log" follow_freq(1) flags(no-parse));
destination loginsight { udp("<loginsight-host>"); };
log { source(vpxd); destination(loginsight); };

You can use tcp instead of udp.


Run service syslog restart to load the new configuration.