Local log files can keep growing while an ESXi host sends nothing to a remote syslog collector. Local storage and remote forwarding have separate configuration. Start by reading the forwarding destination and the host's existing syslog errors, then correlate with the receiver's records. Do not change local retention to fix an unproven remote-delivery problem. A25-S1
This article covers ESXi 8.0 and explicitly identifies a behaviour change at 8.0 Update 2b. All command examples are source-checked but unexecuted. No syslog marker, network probe, firewall change or service reload was performed.
Follow the two output paths
The ESXi syslog service collects messages from VMkernel and other components. Syslog.global.logDir identifies local or datastore-backed log storage. Syslog.global.logHost identifies remote syslog destinations. A blank logHost means logs are not forwarded, even if local files are healthy. A25-S1
The remote value includes protocol and port, such as tcp://collector.example.test:514. Record those explicitly. A receiver expecting another transport or port is a different endpoint, even if the server name is correct.
After reception, retention and rotation belong to the collector. ESXi's local defaultRotate and defaultSize settings do not control how long the remote system keeps data. Therefore “I increased local rotation but the collector still has no history” does not test the forwarding path.
Read configuration before interpreting absence
Prerequisites are the host's exact build, already authorised read access or an existing support capture, the expected collector endpoint and a time interval where a known local event exists. Use a naturally occurring event; creating a test message is outside this inspection.
Broadcom documents the read-only command:
esxcli system syslog config get
It displays existing settings. It does not load new configuration or prove that the configured destination has received anything. Preserve the relevant destination, transport and port in the incident record; remove unnecessary internal details from any wider report.
Next inspect the existing /var/log/.vmsyslogd.err evidence. Broadcom documents failed to write log as an indication of lost communication with the remote server. Record its timestamp and destination context. The KB says forwarding remains stopped after communication is lost until syslogd is restarted/reloaded. Compare the last failed to write log with the last syslog reload or host restart and the collector’s later receipts; recovered network reachability alone does not establish resumed forwarding. Treat a missing reload timeline as unknown. A25-S1
The same source describes reloading the service after certain failures. A reload is an operational change and is not part of the read-only command above. Keep that possible remedy separate from the evidence needed to justify it.
Worked diagnostic branches
Consider three synthetic outcomes:
| Observed evidence | Interpretation |
|---|---|
| Local records exist; remote host value is blank | Forwarding is not configured in the observed state |
| Destination is correct; matching write errors exist | Sender-side evidence supports a delivery failure during that interval |
| No sender error; collector search is empty | Delivery remains unproven; inspect receiver ingestion, filtering and retention |
The third case is not proof that the host transmitted successfully. Equally, an empty search is not proof that no record arrived. Search the correct host identity and time zone, then ask the collector owner to distinguish ingestion from indexing and retention.
Use one existing event's time and distinguishing text where available. Correlation across a narrow interval is more useful than comparing two dashboard totals accumulated over different periods. Be explicit if the collector has already expired that interval.
Check the patch boundary for custom ports
Broadcom states that from ESXi 8.0 Update 2b, configuring non-standard remote syslog ports causes the service to create persistent dynamic firewall rules. Standard ports still require the syslog ruleset to be enabled. Earlier builds have different constraints. A25-S1
This makes the exact build material to diagnosis. Do not assume that a custom-port example written for U2b describes an older 8.0 host. Before U2b, the KB documents a partner-created VIB for a custom port. That is a version-specific change option requiring review, not a package to install during this inspection.
Read existing configuration and the approved network policy with the platform owner. This article does not enable a ruleset, weaken TLS verification or edit a host profile. Each would change the environment under investigation.
The KB’s unexecuted read check for the U2b dynamic-rule branch is esxcli network firewall ruleset rule list | grep dynamic. No matching output is only a filter result: retain command errors and verify that the intended custom-port configuration exists. Do not run the adjacent configuration/reload commands as probes. Editing advanced syslog settings through the UI automatically reloads syslogd, so include saved UI edits in the timeline and cancel inspection dialogs without saving. The KB also says forwarding selected individual log files is unsupported; collector retention and selection must be distinguished from host forwarding.
Acceptance and reversal
The diagnostic result should identify whether forwarding is configured, the precise destination tuple, the relevant sender errors and what the receiver can establish for the same interval. Where evidence stops, say so.
After a separately approved correction, proposed acceptance is that naturally generated records from the intended host appear at the expected receiver with the required timestamps and retention. A successful TCP connection alone would not prove message ingestion or searchable history. No delivery acceptance has been executed here.
Reading settings needs no rollback. A later change plan should preserve original destinations and policies and account for service-reload effects. Repeated reloads without matching evidence can erase the sequence an administrator needs to understand.
Learning notes
- Local log persistence and remote forwarding are separate paths.
- Receiver retention cannot be fixed with ESXi local rotation settings.
- Exact build, protocol, port and time interval make missing-log evidence useful.