Installing Syslog Collector and ESXi Dump Colector for vSphere 5.1

This is not quite as simple as it seems. But, once you know how to do it, it is easy. It took me a couple hours to figure it out.

Of course,  you first need to install these applications on a Windows server. You can use your vCenter Server since they do not take up much space or resources. This part is pretty straight forward.

Once the applications are installed, you must configure your esxi servers. This took me some time to figure out.

For syslog, start by enabling the security port for "syslog" in your firewall settings on each esxi server from the vsphere client. This step is not documented and can easily be overlooked.

Your next step is to go to syslog under "Advanced Settings" on each esxi server. Go to syslog.global.loghost and enter: tcp://<vcenter51 fully qualified server name>:514   This assumes you installed Syslog Collector on your vCenter 5.1 server. If not, use the name of the server you installed it on. And to use port 514.

Once this is done, you will immediately see syslog files being generated.

ESXi Dump Collector is just as easy, but you need to do it from your vSphere Management Server or from the command line on your esxi servers. There is no firewall port to enable for this.

From either vma or the command line on your host, execute the following commands:

> esxcli system coredump network set -v vmk0 -i <ip address where you are running Dump Collector> -o 6500
>esxcli system coredump network set --enable true
>esxcli system coredump network get

The first command tells your host to use the vmkernel port for your Management Port, lets it know the IP address where ESXi Dump Collector is running (probably your vCenter 5.1 Server), and  use port 6500

The second command enables the esxi host to use ESXi Dump Collector

The third command verifies this is working correctly.

Now you have a central location configured for your syslog files and coredumps.