vRealize Log Insight – Error when configuring host syslog forwarding

Posted By Jon on Oct 25, 2015 | 0 comments

I recently re-re-redeployed vRealize Log Insight 6.0 in my lab and had some issues integrating vSphere on one side of my VPN tunnel.  I deployed the OVF per usual and added one vCenter/host and then went to add the second vCenter/host and it said something to the effect of “Could not configure host.  Please see VMware KB 2003322 regarding manually configuring syslog…blah blah.”  I wish I had the exact error but I fixed it and can’t replicate the issue again.

Anyway, I had deployed vSphere Log Insight once, twice, maybe three times for testing and simply deleted the virtual appliance and went on my way.  The configuration utility showed vSphere (with vCenter) but the host showed up as not configured in details:

Log Insight Not Configured

The error I received was pretty vague but I did end up visiting the KB that was linked.  I’ve configured “advanced settings” on hosts before and knew that I could set up syslog attributes from there.  So, when I navigated to Syslog.global.logHost and noticed that it was full of old IP addresses (and one FQDN entry) that pertained to former Log Insight servers:

Old Log Server Entries

So, I took the advice of the window above and “reset to default of on null”.  After setting this field to nothing, I was then able to go back within the vRealize Log Insight and click on “configure” and successfully configure the host for syslog forwarding to the Log Insight server:

Log Insight Host Configured

So, what’s the moral of the story?  Well, I should have known better than to just delete the vRealize Log Insight servers I’ve created without removing configuration.  But, with that said, you may receive a generic error about being unable to configure the host for syslog forwarding if you’ve had Log Insight or other syslog solutions setup in the past.  If you have had former solutions, do yourself the favor when decommissioning them and clear out the Syslog.global.logHost settings!  Hope someone finds this useful and saves themselves from having to scour for solutions.