Configure VxRail Manager syslog for vRealize Log Insight

This is a short post to explain how to configure syslog forwarding from VxRail Manager to vRealize Log Insight.

Depending on the deployment scenario, VxRail may or may not be automatically configured to forward all of its associated logs to vRealize Log Insight. For example with VCF on VxRail, this configuration is automated for all VxRail components, while in other situations this may need to be configured manually.

There are three primary VxRail components to configure:

  • VxRail Manager
  • vCenter Server
  • ESXi Hosts

… with the iDRAC of each VxRail node also being an option.

The configuration of the VxRail vCenter Server in vRLI can also incorporate configuring the log forwarding from the associated ESXi hosts if selected, as shown below:

This is all managed under the built-in vSphere integrations for vRLI. What remains then, if required, is to configure VxRail Manager to forward its logs (marvin.log) to vRLI.

As described in KB504644 VxRail: How to configure a new syslog server , SSH to VxRail Manager as mystic user and switch user to root user, before editing the /etc/rsyslog.conf file with the following additional entries:

# Marvin log to loginsight
$ModLoad imfile
$InputFileName /var/log/vmware/marvin/tomcat/logs/marvin.log
$InputFileTag VxRail
$InputFileStateFile VxRail-Log-State
*.* @<customer remote server ip:514>

Ideally you should use the Log Insight load balancer IP as the target for the <customer remote server ip> (syslog/vRLI server IP), where 514 is the udp port.

Update 31/03/2021: In additional, to the above, the /var/log/mystic/connectors-cluster.log and the /var/log/mystic/connectors-esrs.log can be added to this list, simply by adding them as additional $InputFileName line items, as shown below:

Restart the syslog service using command on VxRail Manager: service rsyslog restart (or reboot the VxRail Manager VM if required).

We can then confirm that the vRLI system is receiving the forwarded logs from our VxRail Manager (vcf2mgmtvxrmgr) in the vRLI UI under Administration > Hosts

On the Interactive Analytics tab we can filter for the VxRail Manager hostname of vcf2mgmtvxrmgr in order to get more detail on each event received since the log forwarding was configured.

Update/Note – After upgrading VxRail 4.7.x to 7.0.x the VxRail part in the remote syslog configuration disappears, and needs to be re-added in the rsyslog.conf. With thanks to Vincent @ for highlighting this important point

The events received from the VxRail Manager source will automatically be included in the General vRLI Dashboard, as shown below

It is also possible to create your own custom VxRail dashboard in vRLI if required. A new (VxRail) dashboard can be created under My Dashboards, where new and existing widgets can be copied and modified as required.

For completeness, if a customer requires the iDRAC logs of the VxRail nodes to be forwarded to vRLI also, then please take a look at this post which covers the required steps, leveraging the Dell iDRAC Content Pack for vRLI, installable directly from the vRLI Content Pack Marketplace, as shown below:

And that’s about it really, I hope that helps!



13 thoughts on “Configure VxRail Manager syslog for vRealize Log Insight

  1. Pingback: VxRail Monitoring and Alerting | Scamallach

  2. Hi Steve,

    Is there a VxRail event in the VxRail manager that you can see if the VxRail Manager is connected to ESRS/Dell Support? Perhaps more importantly an event if the connection is broken. I would like
    receive an email notification from VMware Log Inisght when the connection is lost.


  3. Pingback: Configure VxRail Manager forward logs to vRealize Log Insight – VRMWARE.NL

  4. Hi Steve,
    Is there a listing of the ESRS Heartbeat response codes? I see in the /var/log/mystic/connectors-esrs.log many ESRSClient.sendHeartbeatV1 Response Code 200 events. I assume that response code 200 means that ESRS is working properly. I am looking for the repsonse code that indicates when ESRS cannot connect.


    • Hi Vincent, I am no longer working in the VxRail BU, since moving to Telco 6 months ago. You could try reaching out to David Ring (@DavidCRing) for assistance as he is heavily involved with VxRail Eng. However, he is now on xmas PTO until Jan, so you may need to wait a little while. He’s a great guy though, and should be able to help out


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.