VMware ESXi

Receives syslog messages forwarded from a VMware ESXi host over UDP or TCP and parses them into structured logs. The collector listens on a configurable IP and port, and ESXi hosts must be configured to forward their syslog to that endpoint.

Supported Telemetry

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A reachable collector listening on the configured IP and port (default 0.0.0.0:5140). The listen port must be open in any host, cloud, or network firewall between the ESXi host and the collector.
• Binding to a port below 1024 requires running the collector as root (Linux) or Administrator (Windows). The default port of 5140 avoids this requirement.
• Each ESXi host must be configured to forward its syslog to the collector's IP and port. Set the host's Syslog.global.logHost advanced setting using the syntax protocol://target[:port] (for example tcp://<collector-ip>:5140). For the authoritative ESXi-side steps, see Configure Syslog on ESXi Hosts in the VMware vSphere documentation.
• If you enable TLS, the ESXi hosts must forward over the SSL transport, and the collector must have access to a valid x509 PEM certificate and private key.

Configuration

Logs

Parameter	Type	Required	Default	Description
Listening IP Address	String	No	0.0.0.0	The IP address to bind to and receive syslog.
Listening Port	Integer	Yes	5140	Port to receive syslog on. Collector must be running as root (Linux) or Administrator (Windows) when binding to a port below 1024.

Advanced

Parameter	Type	Required	Default	Description
Enable TLS	Boolean	No	false	Whether or not to use TLS.
TLS Certificate File	String	No	(empty)	Path to the x509 PEM certificate. Relevant only when Enable TLS is true.
TLS Private Key File	String	No	(empty)	Path to the x509 PEM private key. Relevant only when Enable TLS is true.
Parse	Boolean	No	true	Parses the log fields into structured data.

Examples

Receive ESXi syslog over UDP on a non-privileged port

Bind to all interfaces on port 5140 and let the source parse incoming messages into structured logs. This is the default configuration and requires no elevated privileges.

- name: listen_ip
  value: 0.0.0.0
- name: listen_port
  value: 5140
- name: parse
  value: true

Receive ESXi syslog over TLS

Enable TLS and point the source at a certificate and key. The ESXi hosts must forward over the SSL transport to match.

- name: listen_ip
  value: 0.0.0.0
- name: listen_port
  value: 6514
- name: enable_tls
  value: true
- name: cert_file
  value: /opt/tls/esxi-cert.pem
- name: key_file
  value: /opt/tls/esxi-key.pem

Configuration Tips

• The default port 5140 is unprivileged, so the collector does not need root or Administrator. Only choose a port below 1024 (such as 514) if your ESXi hosts cannot be configured to send to a higher port, and run the collector with elevated privileges.
• Leave Parse enabled to get structured fields. Disable it only if you need the raw, unparsed syslog body forwarded downstream.
• When forwarding over UDP, ESXi caps message length (480 bytes for IPv4, 1180 bytes for IPv6). Use TCP or SSL transport on the ESXi side for longer messages.

Troubleshooting

No logs arriving

Symptoms: the source is configured but no ESXi logs reach the pipeline.

Solutions:

1. Confirm each ESXi host's Syslog.global.logHost points at the collector's IP and the configured port, and reload the host syslog config.
2. Verify the listen port is open in any firewall between the ESXi host and the collector, and that the transport (UDP/TCP) matches on both sides.
3. Confirm the collector is actually bound to the configured IP and port.

Permission denied binding the listen port

Symptoms: the collector fails to start or logs a bind/permission error on the listen port.

Solutions:

1. If the port is below 1024, run the collector as root (Linux) or Administrator (Windows), or change the listen port to 5140 or another unprivileged port.

TLS handshake failures

Symptoms: ESXi hosts cannot establish a connection when TLS is enabled.

Solutions:

1. Verify the certificate and key paths are correct and readable by the collector.
2. Confirm the ESXi hosts are forwarding over the SSL transport and trust the certificate presented by the collector.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: vmware-esxi
spec:
  type: vmware_esxi
  parameters:
    - name: listen_ip
      value: 0.0.0.0
    - name: listen_port
      value: 5140
    - name: parse
      value: true

Related Resources

• Configure Syslog on ESXi Hosts — VMware vSphere documentation for enabling syslog forwarding on an ESXi host.
• ESXi Syslog Options — reference for Syslog.global.logHost syntax and transport options.