I'm just setting up graylog2 (which is awesome) to be a syslog server for my virtualised environment. All my hosts and switches are happily logging away to graylog2, which is drawing some pretty graphs. So far, so good.
However, when it comes to fowarding the logs from my vSphere 5.0 hosts, I'm running into some issues. I configure the global syslog setting to have a remote host of
udp://loghost:514 and I go to the graylog console to see what messages come in. For some reason, graylog2 logs the log severity in the 'host' column:
The screenshot shows some
localhost log entries which are correct, and above that some vSphere host entries which obviously are not. All the vsphere entries come in as facility
local4 and with a severity of
The only other time where I had an issue with this was from my Cisco 3750 switch, where I had to explicitly set the syslog forwarding format to
syslog, otherwise I'd get all sorts of strange entries in the 'host' column.
Is this a problem with vSphere, or a bug within graylog2? I've not come across anyone else with this problem, so not sure where to start looking.