Team: Huntress Managed Security Information and Event Management (SIEM)
Product: VMware ESXi, VMware vCenter Server
Environment: VMware ESXi 7.x and 8.x hosts, VMware vCenter Server Appliance 7.x and 8.x
Summary: Learn how to configure VMware ESXi hosts and VMware vCenter Server to forward syslog data to Huntress Managed SIEM.

In This Article

Overview
Before You Begin
Configure ESXi Hosts
Configure vCenter Server
Verify Log Delivery
Example Log Messages
Troubleshooting

Overview

Forwarding syslogs from VMware ESXi and VMware vCenter Server to Huntress Managed SIEM gives the Huntress Security Operations Center (SOC) visibility into hypervisor and virtual infrastructure activity.

You must configure ESXi and vCenter separately because each component sends different telemetry:

• ESXi hosts send host-level activity, including Secure Shell (SSH) and shell sessions, local logins, host tasks, and actions vCenter runs on the host.

• vCenter Server sends management events, including vSphere Client and application programming interface (API) logins, virtual machine (VM) power and configuration changes, permission updates, and single sign-on (SSO) changes.

Configure both ESXi hosts and vCenter Server for complete visibility.

Before You Begin

Review the supported software versions, collection requirements, and prerequisites before configuring log forwarding.

The following table outlines the supported VMware products and syslog collection specifications:

Complete these prerequisites before starting the VMware configuration:

1. Set up a Huntress Agent as a syslog collector on your chosen port and protocol by following Collecting Syslog Sources with Huntress SIEM. Use UDP 514 or TCP 514 unless your environment requires a custom port (see ESXi Firewall Port Requirements).

2. Confirm that every ESXi host and the vCenter Server can reach the internal IP address of the collecting Huntress Agent on that port.

Configure ESXi Hosts

Complete these steps on each ESXi host. If you manage multiple hosts, you can apply this configuration across hosts using a vSphere Host Profile.
 

Option A: vSphere Client (Recommended)

1. In the vSphere Client, select the ESXi host.

2. Go to Configure > System > Advanced System Settings, then click Edit.

3. Filter for Syslog.global.logHost and set the value to the internal IP address, protocol, and port of the collecting Huntress Agent (for example, udp://192.0.2.50:514). If the host already forwards logs to another syslog server, keep the existing entry and add Huntress as a comma-separated value (for example, udp://192.0.2.50:514,tcp://loginsight.example.com:514).

4. Click OK. The syslog service reloads automatically.

5. Go to Configure > System > Firewall, click Edit, and make sure the syslog outgoing rule is enabled.

Option B: esxcli

Running esxcli requires SSH or ESXi Shell access to the host. VMware recommends leaving SSH disabled when you are not using it, so turn it back off after you finish. Enabling SSH is recorded in the host logs and might appear in Huntress Managed SIEM when syslog forwarding is active.
 

Run the following commands on the ESXi host:

esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network firewall refresh
esxcli system syslog config set --loghost='udp://192.0.2.50:514'
esxcli system syslog reload

ESXi Firewall Port Requirements

The built-in ESXi syslog firewall rule opens only outbound UDP 514, TCP 514, and TCP 1514:

• ESXi 8.0 Update 2b or newer automatically opens a firewall rule for a non-standard port.

• Older ESXi versions require a custom firewall vSphere Installation Bundle (VIB) to use any other port. Use UDP 514, TCP 514, or TCP 1514 on the Huntress Agent to avoid creating a custom VIB.
   

Configure vCenter Server

Configure vCenter Server in the management interface and verify that event streaming is active in the vSphere Client.
 

Forward vCenter Logs

1. Log in to the vCenter Server Management Interface (VAMI) at https://<vcenter_address>:5480 as root.

2. From the left menu, select Syslog, then click Configure (or Edit if a server is already listed).

3. Enter the following syslog server details:

   • Server Address: The internal IP address of the collecting Huntress Agent

   • Protocol: UDP or TCP (not TLS or RELP)

   • Port: The port the Huntress Agent listens on (for example, 514)

4. Save your changes.

Confirm Event Streaming Is Enabled

vCenter events, such as logins, VM changes, and permission updates, reach syslog only when event streaming is enabled. Event streaming is enabled by default, but an administrator might have turned it off. Verify the setting in the vSphere Client:

1. In the vSphere Client, select the vCenter Server in the Hosts and Clusters view.

2. Go to Configure > Settings > Advanced Settings.

3. Locate vpxd.event.syslog.enabled and confirm the value is true. If the value is false, click Edit Settings, set the value to true, and save your changes.

Without this setting enabled, vCenter forwards service logs, but it omits the events that contain security details.

Verify Log Delivery

Confirm that both ESXi hosts and vCenter Server are delivering logs to Huntress Managed SIEM:

• ESXi: Run esxcli system syslog mark --message "Huntress test" on the host, or wait a few minutes because ESXi hosts log continuously.

• vCenter: On the VAMI Syslog page, click Send Test Message.

Within a few minutes, the data sources appear in Huntress Managed SIEM under Source Management as VMware ESXi and VMware vCenter, and events become searchable by event.provider using Syslog-VMware-ESXi or Syslog-VMware-vCenter. Huntress identifies the source type automatically from the initial events it receives, so you do not need to add the data source manually.

Example Log Messages

Review these sample log messages to confirm what properly formatted ESXi and vCenter events look like in Huntress Managed SIEM.
 

ESXi (host agent task):

vCenter (user login event):

Troubleshooting

Start with Troubleshooting SIEM Local Syslog Collection, then review these VMware-specific scenarios:
 

VAMI shows the connection status as "Unknown"

This status is expected when using UDP because UDP is connectionless. If logs arrive in Huntress Managed SIEM, no action is needed.

ESXi stopped forwarding after a network outage 

If an ESXi host loses contact with a TCP syslog destination, it might stop forwarding until the syslog service reloads. Run esxcli system syslog reload, or resave the Syslog.global.logHost setting.

vCenter stopped forwarding to every destination

If vCenter forwards logs to multiple servers and a TCP destination becomes unreachable, forwarding can stall for all destinations. Restore connectivity to or remove the unreachable destination.

ESXi logs arrive, but vCenter events do not 

Confirm that vpxd.event.syslog.enabled is set to true (see Confirm Event Streaming Is Enabled).

Long vCenter events appear truncated 

vCenter limits each syslog message to 1,024 characters and sends only the first line of multiline events. This is a vCenter limitation.

Logs appear as Syslog-Generic instead of VMware 

Make sure logs are sent directly from the ESXi host or vCenter Server rather than relayed through an intermediate syslog server that rewrites the message format.