To setup syslog in ESXi 6.5 I found it easier through the ESXCLI, here are the commands to run:
Allow syslog through the firewall:
esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true esxcli network firewall refresh
Set loghost:
esxcli system syslog config set --loghost='tcp://syslog.server.co:514' esxcli system syslog reload
Verify Syslog settings:
esxcli system syslog config get
Troubleshooting:
Check connectivity:
nc -z syslog.server.co 514
If you get the following error when setting the loghost its a DNS issue:
No root object set for output. The command did not provide proper output. Implementation error! The output of this command does not match the declared output type of this command, see errors above.
To check your name resolution:
nslookup syslog.server.co
Check your DNS servers:
esxcli network ip dns server list
If DNS needs to be set:
esxcli network ip dns server add --server=<server>