Forwarding vCenter Server(VCSA) Logs to a Syslog Server

VCSA Syslog Configuration

You will need to edit the following configuration file on the VCSA - /etc/syslog-ng/syslog-ng.conf and add the following lines at the bottom of the file (remember to replace the syslog host with your own):
 

# vpxd source log
source vpxd {
       file( "/var/log/vmware/vpx/vpxd.log" follow_freq(1) flags( no -parse));
};

# Remote Syslog Host
destination remote_syslog {
       udp( "172.30.0.45" port (514));
};

# Log vCenter Server vpxd log remotely
log {
        source(vpxd);
        destination(remote_syslog);
};

 

Note: If you are interested in more details about "sourcing" a local log, take a look at this article here which I used as a reference. 

Once you have saved the configuration file, you just need to restart the syslog client by running the following command:
     service syslog restart

If you login to your remote syslog server, you should now see that your VCSA is forwarding it's vpxd logs over. Pretty simple, right? :) You can of course forward over other vCenter Server logs by adding additional source files. The main key is that there is a symlink that automatically points to the latest log file which you map as the source file.

Source from: http://www.virtuallyghetto.com/2012/08/forwarding-vcenter-server-logs-to.html