It happens every time – an error occurs in VMware, and causes a lot of VMotions. By the time you get the logs off the ESX host, they have rolled off and are no longer valid.
To combat this, we setup a syslog server for all our ESX hosts to report into. To configure the hosts, you either configure each system manually, or you can use the Set-vmHostSyslogServer powershell command. The following command will set all ESX hosts in your datacenter to report to the same syslog server.
get-datacenter “My Datacenter” | get-vmhost | set-vmhostsyslogserver -syslogserver syslog.domain.com:514
When your done, use the following command to confirm everything is configured correctly.
get-datacenter “My Datacenter” | get-vmhost | get-vmhostsyslogserver