SangforHCI log transmission method

Newbie640897 Lv1Posted 2026-Jul-01 11:28

I have a customer who has 15 nodes in 1 cluster of HCI. They want to change the method of sending logs to a syslog server. They used to use UDP as the protocol of syslog and all nodes sent the logs normally. But when they change the method of syslog to TCP, only the master node of the cluster sent the logs (task and alert logs). So my question is the sudden no log from other nodes except the master node of the cluster is normal or is it misconfigured?

By solving this question, you may help 874 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

admin Posted 2026-Jul-10 11:47
  
The behavior you described is not normal. In an HCI cluster, syslog is sent through each node's own IP address, not just the cluster controller IP. Therefore, when the syslog protocol is changed to TCP, all nodes should continue to send logs, not just the master node.

Troubleshooting Steps

1. Verify Syslog Configuration: Log in to the HCI console and navigate to **System → Log Export and Cleanup → Syslog Server**. Confirm that the configuration (IP, port, and protocol) is correct and that a connectivity test from this page is successful. The platform only supports configuring one syslog server.

2. Check Network Connectivity: Since syslog is sent from each node's own IP, ensure that every node in the cluster has network connectivity to the syslog server on the configured TCP port. A firewall or network policy might be blocking traffic from non-master nodes.

3. Check Syslog Server Logs: Examine the logs on the syslog server itself. Look for connection attempts or errors from the IP addresses of the non-master nodes. This can help determine if the traffic is being blocked, rejected, or not sent at all.

4. Review Cluster Health: A cluster synchronization issue could potentially cause problems. Check the cluster's health status and ensure all nodes are online and communicating correctly. The management network is used for inter-node communication.

⚠️ Notes / Risks
- The syslog configuration is cluster-wide and only needs to be set once at the cluster address. The system is designed to send logs from all nodes using their individual management IPs.
- Logs are sent in real-time and are also retained in the HCI console even after forwarding is configured.
- The peer syslog server only needs to comply with the standard syslog protocol and have network connectivity.

If the configuration and network connectivity are verified to be correct, the issue may require deeper investigation into the internal logging service on the non-master nodes.

I Can Help:

Change

Board Leaders

YerkoUm...

Weekly Sharers

Eduardo...

Weekly Questioners