PowerCLI: Configure/Enable Remote Syslog
[Updated ESXCLI call to v2 to reload syslog service]
Been spoiled w/ Log Insight, so didn't realize what I needed to do to get logs forwarded to Splunk Cloud from ESXi hosts. Here is the script I wrote up to do so:
Been spoiled w/ Log Insight, so didn't realize what I needed to do to get logs forwarded to Splunk Cloud from ESXi hosts. Here is the script I wrote up to do so:
#Gets your list of hosts to configure for remote syslog.
$VMHosts = Get-VMHost
#$VMHosts = Get-Cluster MyCluster | Get-VMHost #Uncomment and comment line above if you want to target hosts in a cluster only.
#The remote syslog destination(s).
$SyslogValue = "tcp://192.168.123.5:514,udp://192.168.123.6:514"
#If Replace is set to true, will simply overwrite whatever is populated currently. If False, then it will append.
$Replace = $true
#If ConfirmPreference is set to true, this script will ask you on every single host whether you want to make the change. Set to $False, if you just want it to do it.
$ScriptConfirmPreference = $false
## Don't modify from here ##
$AdvancedSettings= $VMHosts | Get-AdvancedSetting| where {$_.name -match "syslog.global.loghost"}
Foreach ($AdvancedSetting in $AdvancedSettings)
{
If (!$AdvancedSetting.Value) {$AdvancedSetting| Set-AdvancedSetting-Value $SyslogValue-Confirm:$ScriptConfirmPreference}
$CLI = $AdvancedSetting.Entity | Get-EsxCli -V2
Switch ($Replace)
{
$True
{
$AdvancedSetting | Set-AdvancedSetting -Value $SyslogValue -Confirm:$ScriptConfirmPreference
$AdvancedSetting.Entity | Get-VMHostFirewallException| where {$_.Name -eq "syslog"} | Set-VMHostFirewallException-Enabled $true
$CLI.system.syslog.reload.invoke()
}
$False
{
If ($AdvancedSetting.value -match $SyslogValue)
{Write-Host-ForegroundColor:Orange"$($AdvancedSetting.Entity) has a current value of $($AdvancedSetting.value), which seems to contain this value: $($SyslogValue). Replace switch is false, so this script will not change it."}
Else {$AdvancedSetting| Set-AdvancedSetting-Value ($AdvancedSetting.value + "," + $SyslogValue) -Confirm:$ScriptConfirmPreference}
$AdvancedSetting.Entity | Get-VMHostFirewallException| where {$_.Name -eq "syslog"} | Set-VMHostFirewallException-Enabled $true
$CLI.system.syslog.reload.invoke()
}
}
}
Comments