Configure VMware ESXi syslog forwarding using VMware PowerCLI

You can configure syslog setting across multiple VMware ESXi hosts simultaneously using VMware PowerCLI. This method is recommended for automation.

以下の操作が必要です。

  • Ensure VMware PowerCLI is installed and connected to the target VMware vCenter environment.

以下のリソースが必要です。

  • An activated and dedicated 仮想ログ収集ツール（vLC）
    Note: Due to the high event volume observed during Early Access (EA) customer deployments, this integration requires a dedicated vLC to help maintain platform stability and performance and to reduce the risk of service disruptions caused by excessive log volume.
  • Administrator access to VMware ESXi environments through the vSphere Client or ESXi Host Client
  • Network connectivity between VMware systems and the vLC

Configure syslog forwarding

  1. Run this command to set the syslog destination:
    PS 
    Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost | Set-AdvancedSetting -Value "udp://<vlc_ip>:514" -Confirm:$false

    Where vlc_ip is the IP address of your vLC.

  2. Run this command to set the logging level:
    PS 
    Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logLevel | Set-AdvancedSetting -Value "info" -Confirm:$false
  3. Run this command to enable the syslog firewall exception on each host:
    PS 
    Get-VMHost | Get-VMHostFirewallException -Name syslog | Set-VMHostFirewallException -Enabled $true

Provide configuration information to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. ナビゲーションメニューで、［チケットとアラート］ > ［すべてのチケット］をクリックします。
  3. Perform the appropriate action, depending on if you are:
    • A new customer — In the Ticket Type list, select Onboarding. Then, click the existing [Deploy] Site Config: <ticket_subject> ticket.
    • An existing customer — Click Open a New Ticket.
  4. On the Open a New Ticket page, configure these settings:
    • What is this ticket related to? — Select General request.
    • Subject — Enter Syslog changes.
    • Related ticket (optional) — Keep empty.
    • Message — Enter this information for your Concierge Security® Team（CST）:
      • Confirmation that you completed the steps in this configuration guide.
      • The IP address or hostname of the Arctic Wolf Sensor that you used during the configuration.
      • The IP address, timezone, and device type for all sources that you are forwarding.
      • Questions or comments that you have.
  5. Click Send Message.

    Your CST reviews the details to make sure that Arctic Wolf is successfully processing the logs.