Since vRO7 the Log4j Syslog Appender has been deprecated and will be removed. That’s not really a cause for panic as we can use the Log Insight Agent to forward your log files to the Syslog Server.
There are a few catches on the way.
First we need to configure the forwarding:
- Login to the Orchestrator Control Center
- Go to Logging Integration
- Tick the box next to Enable logging to a remote log server to configure Syslog
- Select Use Log Insight Agent
- Enter your FQDN or IP of your Syslog server as well as port 514.
- Select the Syslog Protocol.
- Click on Save
The Log Insight Linux Agent sends the logs via TCP (not UDP) so you may need to adjust your Syslog server
After you have configured the Log Insight settings in the Control Center you still need to configure the Log Insight Linux Agent and tell him what logs to pass on. To do this follow these steps:
- Connect to Orchestrator via SSH
- Edit the file /var/lib/loginsight-agent/liagent.ini
- Add the following entries at the end:
[filelog|scripting]
directory=/var/log/vco/app-server
include= scripting.log; scripting.log.*
[filelog|server]
directory=/var/log/vco/app-server
include=server.log;server.log.*
- Restart the log insight agent with the command
service liagentd restart - Check the logfiles for errors
/var/log/loginsight-agent/liagent_[date].log
This should now forward all the Server and Scripting logfiles to your syslog server. All Orchestrator logfiles can be found at kb.vmware.com/kb/1010956.
The configuration of the Log insight Linux Agent is documented in theVMware vRealize Log Insight Agent Administration Guide