> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/sources/vmware-esxi.md). # VMware ESXi Receives syslog messages forwarded from a VMware ESXi host over UDP or TCP and parses them into structured logs. The collector listens on a configurable IP and port, and ESXi hosts must be configured to forward their syslog to that endpoint. ### Supported Telemetry | Platform | Metrics | Logs | Traces | | -------- | ------- | ---- | ------ | | Linux | | ✓ | | | Windows | | ✓ | | | macOS | | ✓ | | ### Prerequisites * A reachable collector listening on the configured IP and port (default `0.0.0.0:5140`). The listen port must be open in any host, cloud, or network firewall between the ESXi host and the collector. * Binding to a port below 1024 requires running the collector as root (Linux) or Administrator (Windows). The default port of `5140` avoids this requirement. * Each ESXi host must be configured to forward its syslog to the collector's IP and port. Set the host's `Syslog.global.logHost` advanced setting using the syntax `protocol://target[:port]` (for example `tcp://:5140`). For the authoritative ESXi-side steps, see [Configure Syslog on ESXi Hosts](https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/esx-installation-and-setup/installing-and-setting-up-esxi-install/setting-up-esxi-install/configuring-system-logging-install/configure-syslog-on-esxi-hosts-install.html) in the VMware vSphere documentation. * If you enable TLS, the ESXi hosts must forward over the SSL transport, and the collector must have access to a valid x509 PEM certificate and private key. ### Configuration
Bindplane docs - VMware ESXi - image 1
**Logs** | Parameter | Type | Required | Default | Description | | -------------------- | ------- | -------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------- | | Listening IP Address | String | No | `0.0.0.0` | The IP address to bind to and receive syslog. | | Listening Port | Integer | Yes | `5140` | Port to receive syslog on. Collector must be running as root (Linux) or Administrator (Windows) when binding to a port below 1024. | **Advanced** | Parameter | Type | Required | Default | Description | | -------------------- | ------- | -------- | --------- | ------------------------------------------------------------------------ | | Enable TLS | Boolean | No | `false` | Whether or not to use TLS. | | TLS Certificate File | String | No | *(empty)* | Path to the x509 PEM certificate. Relevant only when Enable TLS is true. | | TLS Private Key File | String | No | *(empty)* | Path to the x509 PEM private key. Relevant only when Enable TLS is true. | | Parse | Boolean | No | `true` | Parses the log fields into structured data. | ### Examples #### Receive ESXi syslog over UDP on a non-privileged port Bind to all interfaces on port `5140` and let the source parse incoming messages into structured logs. This is the default configuration and requires no elevated privileges. ```yaml - name: listen_ip value: 0.0.0.0 - name: listen_port value: 5140 - name: parse value: true ``` #### Receive ESXi syslog over TLS Enable TLS and point the source at a certificate and key. The ESXi hosts must forward over the SSL transport to match. ```yaml - name: listen_ip value: 0.0.0.0 - name: listen_port value: 6514 - name: enable_tls value: true - name: cert_file value: /opt/tls/esxi-cert.pem - name: key_file value: /opt/tls/esxi-key.pem ``` ### Configuration Tips * The default port `5140` is unprivileged, so the collector does not need root or Administrator. Only choose a port below 1024 (such as `514`) if your ESXi hosts cannot be configured to send to a higher port, and run the collector with elevated privileges. * Leave Parse enabled to get structured fields. Disable it only if you need the raw, unparsed syslog body forwarded downstream. * When forwarding over UDP, ESXi caps message length (480 bytes for IPv4, 1180 bytes for IPv6). Use TCP or SSL transport on the ESXi side for longer messages. ### Troubleshooting #### No logs arriving Symptoms: the source is configured but no ESXi logs reach the pipeline. Solutions: 1. Confirm each ESXi host's `Syslog.global.logHost` points at the collector's IP and the configured port, and reload the host syslog config. 2. Verify the listen port is open in any firewall between the ESXi host and the collector, and that the transport (UDP/TCP) matches on both sides. 3. Confirm the collector is actually bound to the configured IP and port. #### Permission denied binding the listen port Symptoms: the collector fails to start or logs a bind/permission error on the listen port. Solutions: 1. If the port is below 1024, run the collector as root (Linux) or Administrator (Windows), or change the listen port to `5140` or another unprivileged port. #### TLS handshake failures Symptoms: ESXi hosts cannot establish a connection when TLS is enabled. Solutions: 1. Verify the certificate and key paths are correct and readable by the collector. 2. Confirm the ESXi hosts are forwarding over the SSL transport and trust the certificate presented by the collector. ### Standalone Source ```yaml apiVersion: bindplane.observiq.com/v1 kind: Source metadata: name: vmware-esxi spec: type: vmware_esxi parameters: - name: listen_ip value: 0.0.0.0 - name: listen_port value: 5140 - name: parse value: true ``` ### Related Resources * [Configure Syslog on ESXi Hosts](https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/esx-installation-and-setup/installing-and-setting-up-esxi-install/setting-up-esxi-install/configuring-system-logging-install/configure-syslog-on-esxi-hosts-install.html) — VMware vSphere documentation for enabling syslog forwarding on an ESXi host. * [ESXi Syslog Options](https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-esxi-installation/GUID-8981F5FA-BB2A-47FB-A59A-7FC5C523CFDE.html) — reference for `Syslog.global.logHost` syntax and transport options. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/integrations/sources/vmware-esxi.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.