UTMStack

Articles12 min read

ESXi Logs to SIEM: How to Forward Them and What to Detect

By UTMStack Team

A single VMware ESXi host can run dozens of servers. That makes it one of the most valuable targets in a network, and ransomware groups know it: encrypting the hypervisor takes down every virtual machine on it at once. Yet ESXi cannot run a normal endpoint agent, so the tools that watch your Windows and Linux servers see nothing happen underneath them. Logs are often the only view you have. This guide shows how to send ESXi logs to a SIEM (security information and event management system), which log files matter, and what to alert on.

The short answer: Point each ESXi host’s syslog at your SIEM with esxcli system syslog config set --loghost='tcp://<siem>:514' and esxcli system syslog reload, or set Syslog.global.logHost in the vSphere Client. Open the outbound syslog rule in the ESXi firewall, prefer TCP (Transmission Control Protocol) or encrypted TLS (Transport Layer Security) over UDP (User Datagram Protocol), and turn on audit records, which are off by default. Forward vCenter Server logs as well. Then alert on SSH (Secure Shell) logins, shell use, vSphere Installation Bundle (VIB) installs, syslog and firewall changes, account changes and mass virtual machine shutdowns.

Why ESXi logs matter now

Attacks on ESXi went from rare to routine in a few years. Microsoft reported in 2024 that its incident response cases involving ESXi had more than doubled in three years. These public cases shaped how defenders watch hypervisors.

Attacks on ESXi, 2022 to 2025

Public reports from government agencies and security research teams

  1. Sep 2022Backdoors in software bundlesMandiant finds unsigned installation bundles installed with --force to hide persistent backdoors on ESXi
  2. Feb 2023ESXiArgsCISA and the FBI report over 3,800 servers compromised worldwide; France's CERT-FR ties it to flaws in the SLP service
  3. Jul 2024"ESX Admins" (CVE-2024-37085)Microsoft: a domain group with that name gets full control of domain-joined hosts; used before Akira and Black Basta attacks
  4. Jun 2025Play adds an ESXi sectionCISA: the ESXi variant powers off every virtual machine, then encrypts disks and snapshots
  5. Jul 2025From help desk to hypervisorGoogle: attackers enable SSH from vCenter, reset root passwords and encrypt
  6. Nov 2025Akira updateCISA: a newer ESXi encryptor, and about $244 million in ransom proceeds by late September 2025
CISA is the US Cybersecurity and Infrastructure Security Agency, the FBI the Federal Bureau of Investigation, CERT-FR France's government computer emergency response team, and SLP the Service Location Protocol. Microsoft, Google and Mandiant all give the same advice: send ESXi logs to a SIEM and watch them.

The pattern repeats. Attackers reach the host through an exposed service, a stolen password or a privileged directory group. They turn on SSH or the ESXi Shell, sometimes plant a backdoor, stop the logging service, power off the virtual machines and encrypt their files. Every one of those steps writes a log line, as long as that line leaves the host before the attacker can erase it.

How to forward ESXi logs to a SIEM

ESXi has a built-in syslog service (vmsyslogd) that sends copies of its logs to one or more remote hosts. You install nothing on the host. These steps follow Broadcom’s documentation for ESXi 8.x.

1. Pick a protocol.

ProtocolLog host valueDefault portTrade-off
UDPudp://siem.example.com:514514Simplest, but lost packets are never resent
TCPtcp://siem.example.com:514514Reliable delivery; a good default
TLSssl://siem.example.com:15141514Encrypted in transit; the host must trust the receiver’s certificate

2. Set the destination and reload syslog.

esxcli system syslog config set --loghost='tcp://siem.example.com:514'
esxcli system syslog reload

The value can hold several destinations separated by commas. Broadcom sets no hard limit but suggests five or fewer. You can also choose the message format (RFC 3164 by default, or RFC 5424).

3. Open the ESXi firewall for syslog.

esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network firewall refresh

The syslog rule set allows outbound UDP 514, TCP 514 and TCP 1514. From ESXi 8.0 Update 2b, a non-standard port gets its own firewall rule automatically.

4. Turn on audit records. ESXi 8.0 can keep audit records that show each action with its user and result. They are off by default. Set up persistent storage on the host first, then run:

esxcli system auditrecords local enable
esxcli system auditrecords remote enable

Remote audit records go to the same destinations as the rest of the logs. Google’s threat intelligence team points out why they matter: shell.log shows the command someone typed, while an audit record also shows whether it worked and where the user came from.

5. Test it.

nc -z siem.example.com 514
esxcli system syslog mark --message "SIEM test from esxi-01"

Then search your SIEM for the test message.

6. Do it everywhere. In the vSphere Client, the same setting lives under the host’s Configure tab, then System, Advanced System Settings, Edit, filtered to Syslog.global.logHost. With more than a few hosts, set it through a host profile or a script so new hosts are never missed.

7. Forward vCenter too. vCenter Server sends its own logs from its management interface (port 5480): Syslog, then Forwarding Configuration, with up to three destinations over TLS, TCP, UDP or RELP (Reliable Event Logging Protocol). Turn on remote streaming of events in the same place; it is off by default. vCenter events record actions such as starting the SSH service on a host or changing a host firewall, which attackers often do from vCenter rather than on the host.

Where ESXi logs should go

Copies leave the hypervisor as they are written, so an attacker on the host cannot erase them

Your vSphere environment
SyslogESXi hostsAll host logs, plus audit records once enabled
SyslogvCenter ServerIts own logs and, with streaming on, inventory events
TCP or TLS
SIEMParses each line, checks detection rules, raises alerts
AlertsSSH, VIB installs, power-offs, logging changes
RetentionStored outside the hypervisor for investigations and audits

Which ESXi log files matter

ESXi writes many logs under /var/log. These are the ones a SIEM needs for security work.

FileWhat it recordsSecurity use
auth.logLogins to the host over SSH or the local console, successful and failedPassword guessing, unexpected root logins
shell.logEvery command typed in the ESXi Shell, and the shell being turned on or offThe attacker’s commands, step by step
hostd.logThe host management service: tasks, events, and connections from the vSphere Client and the application programming interface (API)Virtual machine power operations, logins through the API
vpxa.logThe vCenter agent on the hostActions pushed from vCenter
esxupdate.logPatch and software bundle (VIB) installsBackdoor bundles, installs forced with --force
syslog.logManagement service startup, watchdogs, scheduled tasks and console useRestarted services, scheduled tasks, local console use
vmkernel.log and vobd.logCore kernel events: devices, storage, networking, virtual machine startups and observationsContext for crashes, storage errors and unexpected restarts
Audit recordsActions with user, outcome and source, once enabledThe most reliable record of who did what

One detail trips up investigations. shell.log tags commands with a session number, not a user name. Broadcom’s guidance is to match that number with the login in auth.log to see who ran the command. A SIEM that keeps both files together makes that a single search.

What to detect on ESXi

The detections below follow the order of a typical hypervisor attack. Each one relies on events the host or vCenter already logs once forwarding is on.

ESXi detections along the attack path

What to alert on at each stage, and whether UTMStack ships a rule for it

Built-in UTMStack ruleWrite your own rule
  1. Get inReach the host
    Burst of failed loginsauth.logSSH login or SSH enabledauth.log"ESX Admins" group created4727, 4728
  2. Take controlBecome root
    Local account or permission addedshell.logvpxuser running shell commandsvpxuser
  3. StaySurvive reboots
    Unsigned VIB or lower acceptance levelesxupdate.logexecInstalledOnly turned offshell.log
  4. HideBlind the defenders
    Syslog changed or stoppedshell.logHost firewall changedshell.logHost stops sending logsno events
  5. HitEncrypt or steal
    Mass virtual machine power-offvim-cmdAll snapshots removedvim-cmdEncryption commandsopenssl, .shVirtual disk copied outvmkfstools
Alerts in the first two stages give you time to act. By the last stage, every virtual machine on the host is at risk.
DetectionWhat to look for
SSH login or SSH enabledAccepted ... for root in auth.log, SSH service started, SSH enabled from vCenter
Burst of failed loginsMany failed authentications against one host in a few minutes
“ESX Admins” groupA domain group with that name created, or users added to it, on your domain controllers
Account changesesxcli system account add or set, new permissions for an administrator role, root password resets
Backdoor software bundleesxcli software vib install with --force or --no-sig-check, acceptance level set to CommunitySupported
Logging tampered withesxcli system syslog config set or reload, vmsyslogd stopped, Syslog.global.logHost changed
Host firewall changedesxcli network firewall commands, rule sets opened to all addresses
Mass power-offMany vim-cmd vmsvc/power.off or esxcli vm process kill commands in a short time
Encryption on the hostopenssl with .vmdk files, scripts such as encrypt.sh, snapshots removed in bulk
Virtual disk theftvmkfstools clone or export, .vmdk downloads through the datastore browser

Two of these need extra care. The “ESX Admins” attack is visible in Active Directory logs, not on the host, so the rule belongs on your domain controller events (event IDs 4727 and 4728). Our guide to Active Directory SIEM use cases covers the audit settings those events need. And a host that goes silent is itself a warning: Mandiant has seen ESXi malware stop vmsyslogd, so alert when a host that normally sends logs stops.

For how rules like these are written and tuned, see SIEM correlation rules. For the wider attack chain on Windows and Linux, see ransomware detection.

Hardening that makes ESXi logs useful

Logs work best on a host that limits how attackers get in. These settings, from Broadcom’s ESXi security baseline unless noted, also cut noise, because every SSH login becomes worth looking at.

  • Lockdown mode. Set it to normal so administrators work through vCenter, not directly on the host.
  • SSH and the ESXi Shell stopped. Start them only for maintenance. Set UserVars.ESXiShellTimeOut to 600 seconds and UserVars.ESXiShellInteractiveTimeOut to 900 so forgotten sessions close.
  • Account lockout. Keep Security.AccountLockFailures at 5 and Security.AccountUnlockTime at 900 seconds.
  • Only signed software. Keep the acceptance level at PartnerSupported or higher, and set VMkernel.Boot.execInstalledOnly to true so only installed binaries can run.
  • Active Directory. CVE-2024-37085 is fixed in ESXi 8.0 Update 3. On older builds, Broadcom’s workaround changes Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd to false and clears Config.HostAgent.plugins.hostsvc.esxAdminsGroup.
  • Off the internet. CISA’s ESXiArgs guidance: keep management interfaces off the public internet, and turn off the SLP service if you do not use it.
  • Supported versions. ESXi 7.x reached the end of general support on October 2, 2025. ESXi 8.x general support runs until October 11, 2027.

How UTMStack handles ESXi logs

We build UTMStack, so weigh our view accordingly. Here is how it works with ESXi, including what it does not do.

  • Collection without an agent. The UTMStack Collector, a small Linux service that runs on the UTMStack server or another Linux host in your network, listens for ESXi syslog on port 7002. TCP is the default, UDP is available, and TLS works once you load a certificate. The setup screen shows the exact esxcli commands for your server. Nothing is installed on ESXi. See integrations.
  • Parsing. A dedicated parser splits each ESXi line into the host name, process and message, so searches and rules work across all hosts.
  • Fourteen built-in ESXi rules. They cover direct SSH logins, unsigned VIB installs, local account changes, syslog disruption, host firewall changes, ransomware activity, virtual disk theft, vSphere API abuse, vCenter attack indicators, PowerCLI use, signs of host compromise, virtual machine escape, hypervisor escape and VMware Tools exploits. Each maps to MITRE ATT&CK and is checked as each log arrives, before storage, alongside the rest of the 600+ detection rules.
  • Context from other sources. The same instance can hold your domain controller, firewall and Windows logs, so an SSH login on a host can be read next to the directory change or firewall connection that came before it.
  • Free to start. Syslog integrations, ESXi included, are part of the free Community edition, which installs on your own Linux server.

What it does not do:

  • No response on the host itself. UTMStack response flows run through agents on Windows, Linux and macOS. ESXi has no agent, so stopping SSH or isolating a hypervisor is a manual step, or a flow on another system such as a Linux gateway.
  • No built-in rule for the “ESX Admins” group or for new privileged groups in Active Directory. Add a custom rule on event IDs 4727 and 4728.
  • The rules match message text. The SSH rule fires on every SSH login, which is right for hosts where SSH should be off, and noisy where admins use it daily. Tune it to your environment.

UTMStack is priced per device, never by log volume, and each ESXi host counts as one device. Ask for a quote or see pricing.

Frequently asked questions

Which port does ESXi use for syslog? By default, UDP and TCP use port 514 and TLS uses 1514. You can set any port from 1 to 65535 in the log host value. From ESXi 8.0 Update 2b, a custom port gets a firewall rule automatically; on older builds you must open it yourself.

Can I install a SIEM agent on ESXi? No. ESXi does not run ordinary Windows or Linux agents. Its built-in syslog service, plus audit records, is the supported way to get its logs out.

Does vCenter send ESXi host logs to the SIEM for me? Not through its forwarding setting, which covers vCenter’s own log files. Configure both: each host sends its own logs through Syslog.global.logHost, and vCenter forwards its own logs and, if you turn on event streaming, its events.

Should I use UDP or TCP for ESXi syslog? TCP, or TLS if your SIEM supports it. UDP drops messages silently when the network is busy, and the moments of heavy activity are often the ones you need.

How do I know a host stopped sending logs? Alert when a host that normally sends logs goes quiet for longer than its usual gap. Attackers have been seen stopping the ESXi syslog service, so silence can be an early sign of an attack.

Sources

Keep reading