PowerCLI: Configure/Enable Remote Syslog
[Updated ESXCLI call to v2 to reload syslog service]
Been spoiled w/ Log Insight, so didn't realize what I needed to do to get logs forwarded to Splunk Cloud from ESXi hosts. Here is the script I wrote up to do so:
Been spoiled w/ Log Insight, so didn't realize what I needed to do to get logs forwarded to Splunk Cloud from ESXi hosts. Here is the script I wrote up to do so:
#Gets your list of hosts to configure for remote syslog. $VMHosts = Get-VMHost #$VMHosts = Get-Cluster MyCluster | Get-VMHost #Uncomment and comment line above if you want to target hosts in a cluster only. #The remote syslog destination(s). $SyslogValue = "tcp://192.168.123.5:514,udp://192.168.123.6:514" #If Replace is set to true, will simply overwrite whatever is populated currently. If False, then it will append. $Replace = $true #If ConfirmPreference is set to true, this script will ask you on every single host whether you want to make the change. Set to $False, if you just want it to do it. $ScriptConfirmPreference = $false ## Don't modify from here ## $AdvancedSettings= $VMHosts | Get-AdvancedSetting| where {$_.name -match "syslog.global.loghost"} Foreach ($AdvancedSetting in $AdvancedSettings) { If (!$AdvancedSetting.Value) {$AdvancedSetting| Set-AdvancedSetting-Value $SyslogValue-Confirm:$ScriptConfirmPreference} $CLI = $AdvancedSetting.Entity | Get-EsxCli -V2 Switch ($Replace) { $True { $AdvancedSetting | Set-AdvancedSetting -Value $SyslogValue -Confirm:$ScriptConfirmPreference $AdvancedSetting.Entity | Get-VMHostFirewallException| where {$_.Name -eq "syslog"} | Set-VMHostFirewallException-Enabled $true $CLI.system.syslog.reload.invoke() } $False { If ($AdvancedSetting.value -match $SyslogValue) {Write-Host-ForegroundColor:Orange"$($AdvancedSetting.Entity) has a current value of $($AdvancedSetting.value), which seems to contain this value: $($SyslogValue). Replace switch is false, so this script will not change it."} Else {$AdvancedSetting| Set-AdvancedSetting-Value ($AdvancedSetting.value + "," + $SyslogValue) -Confirm:$ScriptConfirmPreference} $AdvancedSetting.Entity | Get-VMHostFirewallException| where {$_.Name -eq "syslog"} | Set-VMHostFirewallException-Enabled $true $CLI.system.syslog.reload.invoke() } } }
Comments