Home vSphere Web Client

Forward vCenter Server Appliance Log Files to Remote Syslog Server

A few days ago I was required to obtain some audit logs from our SIEM system (Sumologic) and from vCenter and I noticed that our vCenter logs weren’t going in to Sumologic and that the log files required for SSO auditing or the VPXD log (where, among other things, stipulates what client was used by who to connect) were rotating every 7 days. This was not good. So I decided what better time than now to forward vCenter syslogs to Sumologic.

It was a little more complex than just enabling syslog through appliance management as by default, this does not collect the SSO logs, like:

  • /var/log/vmware/sso/ssoAdminServer.log – Auditing SSO logins
  • /var/log/vmware/sso/vmware-identity-sts.log – Auditing SSO user changes

I found this out by scouring the internet and piecing little pieces together and eventually, creating a rock solid syslog source for our vCenter Servers.

Please note: This is not an officially supported configuration by VMware and for larger environments, this could potentially have an impact on the vCenter Server service, so please take caution in the logs you decide to forward. And as always, test this in a lab first.

I also want to mention that this needs to be done on each VCSA instance, i.e. if you have a vCenter with an External PSC, this would need to be done on both servers, in order to collect all the logs.

So, lets begin:

Continue reading Forward vCenter Server Appliance Log Files to Remote Syslog Server →

Upgrading VCSA 6.5u1 to 6.7

Murphy’s Law, just as I upgrade to  6.5u1, 6.7 gets released. So, I am going to do an upgrade in my lab so I can start playing around with all the cool new features.

Before moving on, it is HIGHLY recommended you read through the following VMware articles:

Also, as a prerequisite, and mentioned in the 6.0u3 to 6.5u1 upgrade,  I recommend moving all systems to a single host, disabling DRS (or setting it to manual) and performing a snapshot of the VMs.

The upgrade path also seems identical in the sense that you need to do ALL PSCs FIRST then do the vCenter. But you might have additional VMware systems, so please follow the Update sequence for vSphere 6.7 and its compatible VMware products (53710) article.

Continue reading Upgrading VCSA 6.5u1 to 6.7 →

Creating vSwitch Names for new vSwitches on ESXi Hosts using Host Web Client

A little while back, I wrote on Changing your vSwitch Names on ESXi Host.  I found another way to do this, but unfortunately, this method ONLY works for NEW vSwitches.

Once the vSwitch has been created, you cannot change the name to something else. If you made a mistake and need to change it, you would need to either:

a. Removing the vSwitch and recreating it
b. Doing the Changing your vSwitch Names on ESXi Host option.

login
Login to the ESXi Host directly – https://ip-or-hostname/ui/ (note the trailing “/” after ui)

Continue reading Creating vSwitch Names for new vSwitches on ESXi Hosts using Host Web Client →