PowerCLI: Configure/Enable Remote Syslog

Been spoiled w/ Log Insight, so didn't realize what I needed to do to get logs forwarded to Splunk Cloud from ESXi hosts.  Here is the script I wrote up to do so:

#Gets your list of hosts to configure for remote syslog.
$VMHosts = Get-VMHost
#$VMHosts = Get-Cluster MyCluster | Get-VMHost #Uncomment and comment line above if you want to target hosts in a cluster only.
#The remote sys log destination
$SyslogValue = "tcp://192.168.123.5:514"
#If Replace is set to true, will simply overwrite whatever is populated currently.  If False, then it will append.
$Replace = $true
#If ConfirmPreference is set to true, this script will ask you on every single host whether you want to make the change.  Set to $False, if you just want it to do it.
$ScriptConfirmPreference = $false

## Don't modify from here ##
$AdvancedSettings= $VMHosts | Get-AdvancedSetting| where {$_.name -match "syslog.global.loghost"}
Foreach ($AdvancedSetting in $AdvancedSettings)
    {
    If (!$AdvancedSetting.Value) {$AdvancedSetting| Set-AdvancedSetting-Value $SyslogValue-Confirm:$ScriptConfirmPreference}
    $CLI = $AdvancedSetting.Entity | Get-EsxCli
    Switch ($Replace)
        {
        $True
            {
            $AdvancedSetting | Set-AdvancedSetting -Value $SyslogValue -Confirm:$ScriptConfirmPreference
            $AdvancedSetting.Entity | Get-VMHostFirewallException| where {$_.Name -eq "syslog"} | Set-VMHostFirewallException-Enabled $true
            $CLI.system.syslog.reload()
            }
        $False
            {
            If ($AdvancedSetting.value -match $SyslogValue)
            {Write-Host-ForegroundColor:Orange"$($AdvancedSetting.Entity) has a current value of $($AdvancedSetting.value), which seems to contain this value: $($SyslogValue).  Replace switch is false, so this script will not change it."}
            Else {$AdvancedSetting| Set-AdvancedSetting-Value ($AdvancedSetting.value + "," + $SyslogValue) -Confirm:$ScriptConfirmPreference}
            $AdvancedSetting.Entity | Get-VMHostFirewallException| where {$_.Name -eq "syslog"} | Set-VMHostFirewallException-Enabled $true
            $CLI.system.syslog.reload()
            }
       
        }

    }

No comments: