→ Applies to: VMware ESXi 6.5.0 and above

This procedure explains how to configure an ESXi host to forward syslog messages to the Cyrebro platform in addition to an existing syslog destination, ensuring log continuity while enabling ingestion by Cyrebro.

Step 1. Login to VMware ESXi GUI

Step 2. Access Users page (Manage menu, Advanced settings tab)

Step 3. Click Syslog.global.logHost key, then on Edit option

Step 4. Add Cyrebro Collector IP, then click Save 

To add another destination when one is already configured, simply append a comma (no space) followed by the Cyrebro collector's IP and the relevant port.
IMPORTANT 
The IP shown here is just an example. You must enter the actual IP of your own Cyrebro collector

Step 5. Enable outbound syslog traffic on the ESXi firewall

esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true

Step 6. Apply the configuration without restarting the host

esxcli system syslog reload

This command hot-reloads the syslog service. It does not disconnect the host from vCenter and does not affect virtual machines.