Security Compliance

Integrate VMware ESXi with SolarWinds SEM

This article provides procedures for configuring VMware ESXi to log to your SEM appliance and configuring the ESXi connectors on your SEM appliance.

First published date

10/10/2018 1:18 PM

Last published date

4/8/2025 6:27 PM

Overview

This article outlines the procedures for configuring VMware ESXi to log to your Security Event Manager (formerly Log & Event Manager) appliance and configuring the ESXi connectors on your SEM appliance (VMware ESXi 3.5 and later)

Product section

Security Event Manager

Resolution

Configure ESXi to log to your SEM appliance 

Complete one of the procedures below according to your version of ESXi.

Configure logging for ESXi version 5.0:

  1. Open the vSphere Command-Line Interface.
  2. Enter: 
    esxcli system syslog config set --loghost='udp://LEMHostnameOrIP:514'

    where LEMHostnameOrIP is the hostname or IP address for your SEM appliance.

  1. Run the following commands on the ESX host: 
    esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
    esxcli network firewall refresh
  2. Enter the following to load the new configuration: 
    esxcli system syslog reload


Configure logging for ESXi versions 3.5-4.x:

  1. Open the vSphere Command-Line Interface.
  2. Enter: 
    vicfg-syslog.pl --server ESXiHostnameorIP --username ESXiUsername 
--password ESXiPassword --setserver LEMHostnameOrIP --setport 514
    where:
  • ESXiHostnameOrIP is the hostname or IP address for your ESXi host.
  • ESXiUsername is the username for your ESXi administrator.
  • ESXiPassword is the corresponding password.
  • LEMHostnameOrIP is the hostname or IP address for your SEM appliance.

Configure the ESXi connectors on your SEM appliance 

SEM Flash console

  1. On your SEM console menu bar, navigate to Manage > Appliances, and then log into your SEM Manager as an administrator.
  2. Next to your SEM Manager, click the gear icon, and then select Connectors.
  3. In the Connector Configuration window, enter ESXi in the search box at the top of the Refine Results pane.
  4. Next to the VMWare ESXi Hostd log connector, click the gear icon, and then select New.
  5. Enter a custom Alias or accept the default.

    Do not change the Log File value. The ESXi connectors are pre-configured with the correct facilities for their corresponding log files.

  6. After configuring the connector, click Save.
  7. Next to the new connector (denoted by an icon in the Status column), click the gear icon, and then click Start.
  8. Repeat Steps 4 to 7 for both the VMWare ESXi Messages Log and VMWare ESXi Vmkernel Log connectors.
  9.  To exit the Connector Configuration window, click Close.

SEM HTML5 console

  1. In the SEM Events Console, navigate to Nodes > Manager Connectors.
  2. In the search box, enter esxi.
  3. Select the VMWare ESXi Hostd log connector, and then click Add Connector.
  4. Enter a new name, or accept the default.
  5. Click Add.
  6. Under Configured connectors, select the connector, and then click Start.
  7. Repeat for both the VMWare ESXi Messages Log and VMWare ESXi Vmkernel Log connectors.