VMware ESXi and vCenter: send syslog and SNMP traps to MobiObs

Before you start

The MobiObs device is 10.20.4.9 in the examples; use the address on its Network screen. Android does not let apps listen on ports below 1024, and MobiObs uses the same ports on every platform, so use these destinations:

The commands run in the ESXi Shell or over SSH as root. VMware advises against leaving SSH enabled, so turn it off again when you are done; the same setting can also be made in the vSphere Client, as shown below. TCP is used here because VMware documents arbitrary ports for TCP, and recommends against UDP for syslog because messages can be dropped on the way. The vmkernel interface that ESXi sends from must be able to reach the MobiObs device, which usually means the management network.

ESXi syslog

ESXi 7.0 / 8.0: remote log host on tcp/5514

esxcli system syslog config get
esxcli system syslog config set --loghost='tcp://10.20.4.9:5514'
esxcli system syslog reload

Run config get first and note the current Remote Host value. config set --loghost replaces the whole list, so if a permanent log host is already configured, give both, separated by a comma: --loghost='tcp://syslog.example.net:514,tcp://10.20.4.9:5514'. If no port is given, ESXi uses 514 for UDP and TCP.

In the vSphere Client, the same value is the host’s Syslog.global.logHost advanced setting: select the host, go to Configure > System > Advanced System Settings, click Edit, filter for Syslog.global.logHost and enter tcp://10.20.4.9:5514, including the protocol and port.

The ESXi firewall

The ESXi firewall controls outgoing syslog too. Its built-in syslog rule set covers the default ports (514 for UDP and TCP, 1514 for SSL). For other ports, it depends on the version:

• ESXi 7.0 Update 3q and later, and ESXi 8.0 Update 2b and later: when the log host uses a non-standard port such as 5514, ESXi creates the firewall rule for it automatically. Nothing else to do.
• Earlier builds: the built-in rule set does not open 5514, and VMware’s documented way to open a custom port is a partner-supplied VIB. On a site visit, the practical alternative is to send to the default port 514 on a relay that forwards to MobiObs; see the port 514 guide.

ESXi: enable the syslog rule set (default ports)

esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network firewall refresh

These lines are needed when you send to a standard port, for example to a relay on tcp/514.

ESXi SNMP traps

ESXi 7.0 / 8.0: SNMPv2c traps to udp/1162

esxcli system snmp get
esxcli system snmp set --communities MOBIOBS-RO
esxcli system snmp set --targets 10.20.4.9@1162/MOBIOBS-RO
esxcli system snmp set --enable true
esxcli system snmp test

The target format is address@port/community; without a port, ESXi sends to 162. Like the log host, --targets replaces all existing targets, so include any existing ones from snmp get, separated by commas. esxcli system snmp test sends a warmStart trap to every target. Enter the same community in MobiObs.

vCenter Server

1. Log in to the vCenter Server management interface at https://<vcenter>:5480 as root.
2. Select Syslog. In Forwarding Configuration, click Configure (or Edit if hosts are already listed).
3. Enter 10.20.4.9 as the server address, choose TCP as the protocol and 5514 as the port, and click Save.
4. Click Send Test Message.

vCenter forwards to at most three destinations, so check how many are already in use before adding MobiObs.

Verify it works

ESXi: send a test message

esxcli system syslog mark --message="MobiObs test from ESXi"

• Logs. The test message appears within a second or two, under the host’s name. ESXi sends each log with its own app name, such as hostd, vpxa or vmkernel, so filter Logs by app to follow one service. The vCenter test message appears the same way, under the appliance’s name.
• Traps. The warmStart trap from esxcli system snmp test appears on the SNMP Traps screen with the host as agent.
• Sources. Lists each host and the appliance with the last-seen time, which is the quickest check when several hosts are configured.

Troubleshooting

• The test message does not arrive. Check esxcli system syslog config get for a typo in the URL, then the firewall section above for your build.
• It worked until the MobiObs device was away for a while. ESXi reconnects TCP log hosts on its own, but a syslog reload forces it.
• The permanent log host stopped receiving. --loghost replaced the list; set it again with both hosts.
• Traps are flagged in MobiObs. The community in the target does not match the one in MobiObs.
• vmkernel messages are very frequent. Filter Logs by severity, or by app, to keep the view readable.

Remove it afterwards

Set the log host back to the value you noted, or to an empty string (--loghost='') if there was none, and run esxcli system syslog reload. Set the SNMP targets back to the previous list, or disable the agent with --enable false if it was off. In vCenter, delete the MobiObs forwarding entry. Turn SSH off again.