Accenture MDR Quick Start Guide for VMware vSphere(Syslog)

This quick start guide will help Accenture MDR customers configure VMware Vsphere to send logs to the Log collection Platform (LCP).

This document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configure Syslog on ESXi Hosts using Web UI
4 Configure Syslog on ESXi Hosts using CLI
5 Configure Syslog on vCenter Server :
6 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

Vmware Vsphere

LCP

514 (UDP)

Default port

Note: Accenture MDR not support any syslog relayers or forwarders. Log forwarding should done via vmware IP Address.

Configure Syslog on ESXi Hosts using Web UI

Login to vSphere Client inventory.
Select the ESXi host where syslog needs to be configured and login to that ESXi host.
Once login is established, click on Configure
Under System, click Advanced System Settings. Select Syslog.global.loghost

5. Click Edit.

6. Enter the string in the format protocol://hostname|ipv4|'['ipv6']'[:port]

7. For Example - udp://lcpip:514 or tcp://lcpip:601

8. Click OK

Configure Syslog on ESXi Hosts using CLI

Login to ESXi host using SSH

2. Once logged in , enter the below command

esxcli system syslog config set --loghost=udp://lcpip:514
esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network fierwall refresh

Syslog configuration is enabled and working now.

Configure Syslog on vCenter Server :

Pre-requisites : enable and configure the streaming of vCenter Server events to a remote syslog server from the vCenter Server Management Interface.

In the vSphere Client, navigate to the vCenter Server instance.
Select the Configure tab.
Expand Settings option, and select Advanced Settings.
Click EDIT SETTINGS.
Click on the filter text box present in the Name column of the table header. Type vpxd.event, and press Enter.
Enable vpxd.event.syslog.enabled option.
Click SAVE.

In the vCenter Server Management Interface, select Syslog.
In the Forwarding Configuration section, click Configure if you have not configured any remote syslog hosts. Click Edit if you already have configured hosts.
In the Create Forwarding Configuration pane, enter the server address of the destination host. The maximum number of supported destination hosts is three.
From the Protocol drop-down menu, select the protocol to use.
In the Port text box, enter the port number to use for communication with the destination host.
Click Save.
Verify that the remote syslog server is receiving messages.
In the Forwarding Configuration section, click Send Test Message.
Verify on the remote syslog server that the test message was received.
The new configuration settings are shown in the Forwarding Configuration section.

LCP Configuration Parameters

Table 1-2: The Vmware Vsphere event collector (Syslog -4012) properties to be configured by Accenture are given in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog.
Host Names/IP Addresses	<IP Address of the host enabled for syslog>	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: No syslog signatures are available hence using the VMware IP address to collect the logs.
Port Number	514	The default port for UDP.