How to Forward ESXi Syslog to a Remote Log Server

To forward ESXi syslog to a remote server, set the host's Syslog.global.logHost option to your collector's address with a protocol and port, reload the syslog service, and confirm the collector receives events. You can do this per host with esxcli, in the vSphere Client's Advanced System Settings, or across a cluster with Host Profiles. Remote copies matter because an attacker with admin rights on the host can clear local logs.

Why forward ESXi syslog at all?

Logs stored only on an ESXi host can be deleted or altered by anyone who controls that host. Forwarding sends a copy to a system the attacker would also have to compromise, which keeps the evidence intact.

This is not theoretical. CrowdStrike documented the China-nexus group Warp Panda clearing logs on VMware infrastructure, and in October 2026 CISA added the ESXi logging zero-day CVE-2026-41709 to its KEV catalog after the same group used it to keep admin operations out of the audit trail. Remote forwarding does not fix that bug (only the patch does), but it limits what an intruder can erase.

What are the ESXi syslog settings?

ESXi has five global syslog options. Broadcom's knowledge base article "Configuring syslog on ESXi" (KB 318939) describes them:

• Syslog.global.logHost: a comma-delimited list of remote servers that receive logs. If it is blank, nothing is forwarded. Include the protocol and port, such as tcp://hostname:514, udp://hostname:514 or ssl://hostname:1514.
• Syslog.global.logDir: where logs are saved locally, in the format [DatastoreName] DirectoryName. On ESXi 6.7 and later the directory must already exist, or the setting fails.
• Syslog.global.logDirUnique: creates a per-host subdirectory named after the host, which helps when several hosts share one datastore directory. The default is false.
• Syslog.global.defaultRotate: the number of local log files kept. The default is 8.
• Syslog.global.defaultSize: the size in KB of each local log file before rotation. The default is 1024 KB.

The rotate and size settings affect only local retention. Your collector's retention is configured on the collector.

How do you configure ESXi syslog forwarding with esxcli?

Open an ESXi shell where esxcli is available, check the current configuration, set the log host, and reload the syslog service. The four commands below come from Broadcom KB 318939.

Show the current settings:

esxcli system syslog config get

Point the host at a collector over TCP port 514 (replace the placeholder with your collector's address):

esxcli system syslog config set --loghost='tcp://<syslog_server_IPv4>:514'

Load the new configuration:

esxcli system syslog reload

Test that the collector port is reachable from the host:

nc -z <RemoteHostname> 514

To remove a remote log host later, Broadcom documents esxcli system syslog config set --reset=loghost.

Choosing a protocol

UDP is the simplest option, but it drops messages without notice when the network or collector is busy. TCP gives you delivery you can confirm. The ssl:// form on port 1514 encrypts logs in transit, which matters when they cross a network an attacker might watch. Pick the strongest option your collector supports, and allow that port through the ESXi firewall and any firewall in between.

How do you configure syslog for a whole cluster?

Use Host Profiles so every host gets the same settings and drift is visible. In the vSphere Client, open Host Profiles under the management section, create or edit a profile, set the syslog options under Advanced Configuration, then save the profile and attach it to the hosts.

If you configured one host by hand first, extract a profile from it as a reference host. Its five syslog options then appear under the profile's advanced configuration section. For a single host, the same options are in Advanced System Settings for that host in the vSphere Client.

How to verify ESXi syslog forwarding works

Configuration is not proof. After you set the log host:

1. Perform a known, harmless admin action on the host, such as logging in to the host client with a named account.
2. Confirm the matching event arrives at the collector with the right hostname and timestamp.
3. Check that clocks on the host and collector agree. Use NTP on both, or timelines will not line up during an incident.
4. Add an alert on the collector for hosts that stop sending. A host that goes quiet is a signal in itself.

Repeat the check after upgrades and after any change to Host Profiles.

Hardening the collector

A remote collector only helps if the ESXi administrator cannot reach into it. Keep it on separate credentials, outside the vSphere management domain, with write-once or append-only storage where you can. CrowdStrike's guidance for Warp Panda recommends forwarding vSphere syslog to an external platform for exactly this reason. Our overview of insufficient logging vulnerabilities explains why a second record matters even when the host is patched, and why hypervisor log retention must live off the host covers retention planning.