vSphere Syslog Slam

Maybe you are like me and you have a new syslog destination (SIEM is grand).  Maybe you want to ensure that all of your vSphere hosts are configured the same.

Automation being king, this will do it.  The general process for each host:

1. Set the syslog destination 
2. Insure a firewall exception 
3. Restart the syslog service.

In vSphere 5.1 the Set-VMHostSysLogServer cmdlet was added to PowerCLI.  While there are other ways to accomplish the same task, I tend to prefer using any method that is more obvious when coding.  Set-VMHostSysLogServer it is.

	$syslog = 'udp://1.2.3.4:514' # change to your syslog host
	$Hosts = Get-VMHost | Sort-Object Name
	$Hosts | ForEach-Object {
	try {
	Write-Output "Setting $_ Syslog to $syslog"
	Set-VMHostSysLogServer -VMHost $_ -SysLogServer $syslog -ErrorAction Stop | Out-Null
	}
	catch [Exception] {
	Write-Output " Operation failed."
	continue
	}
	$res = Get-VMHostSysLogServer -VMHost $_
	if ("$($res.Host):$($res.Port)" -eq $syslog) {
	# the setting took, add firewall exception and restart the service
	Write-Output " Enabling syslog firewall exception on $_"
	Get-VMHostFirewallException -VMHost $_ -Name "syslog" | Set-VMHostFirewallException -Enabled:$true | Out-Null
	Write-Output " Restarting Syslog on $_"
	$esxCli = Get-EsxCli -VMHost $_ -V2
	if ($esxCli.system.sysLog.reload.invoke()) {
	Write-Output " Reloaded"
	}
	}
	}

view raw Set-Syslog.ps1 hosted with ❤ by GitHub

Cheers!