Are they actually crashing and giving you the purple screen? Usually in that case you'll need a memory dump. VMware has a tool for that bundled with vCenter (not installed by default, but it's on the media). Just be aware that with ESXi 5.0, the vmkernel interface used needs to be on a standard vSwitch. 5.1 lets you use a VDS though.
VMware KB: ESXi Network Dump Collector in VMware vSphere 5.x
EDIT: Noticed a couple other questions I hadn't answered. The vCenter Syslog Collector is only necessary if you don't have a syslog server already, and it sounds like you do. If you're receiving logs on the syslog server, then you've got it configured correctly. Scratch and syslog will have duplicate information. Same stuff in both places. There is no scratch partition created when ESXi is installed on flash (or even when booting from SAN by default), so it goes onto a ramdisk. If VMware needs those after a crash, you'll need the memory dump, which in your case means you need a network dump collector.