Configure rsyslog in vCAC vRA appliance to send to a syslog server

One option not available in the vCloud Automation Center (vCAC) appliance VAMI is the ability to send logs to a syslog server, such as Splunk or LogInsight (does anyone know if this has been exposed in vRA 6.1?), thankfully since the appliance is built on linux, its just a matter of configuring rsyslog.  If you are using LogInsight you can use the LogInsight Content Pack.  While I have LogInsight, I want to do this manually to send logs as if I were using a generic syslog server.  As you can see here, none of my vCAC logs are here (my appliance is named vcacapp)

Here is how to configure the vCAC appliance to send logs:

  • SSH to your vCAC / vRA appliance
  • Type vi /etc/rsyslog.conf
  • At the end of the file enter
*.*    loginsight.fqdn.tld:port
  • For example loginsight.test.lab:514
  • Save the file and restart syslog by typing
service syslog restart

Now if you go back to LogInsight or whatever syslog server you are using you can see logs being collected.  Logging, like monitoring involves a bit of science instead of just dumping logs into your syslog server.  If you have LogInsight, check out their content packs as that would be the preferred option in my opinion.

Related Posts