per document generic syslog requires that MSO is deployed on Application Service Engine and not in VMware OVA. what is your deployment model?
Streaming System Logs to External Analyzer
Cisco ACI Multi-Site Orchestrator allows you to send the Orchestrator logs to an external log analyzer tool
in real time. By streaming any events as they are generated, you can use the additional tools to quickly parse,
view, and respond to important events without a delay.
This section describes how to enable Multi-Site Orchestrator to stream its logs to an external analyzer tool,
such as Splunk or syslog.
Before you begin
• This release supports only Splunk and syslog as external log analyzer.
• This release supports syslog only for Multi-Site Orchestrator in Application Services Engine deployments.
• This release supports up to 5 external servers.
• If using Splunk, set up and configure the log analyzer service provider.
For detailed instructions on how to configure an external log analyzer, consult its documentation.
• If using Splunk, obtain an authentication token for the service provider.