The vpxa management agent fills local logs in ESXi 4.1
search cancel

The vpxa management agent fills local logs in ESXi 4.1

book

Article ID: 301709

calendar_today

Updated On:

Products

VMware

Issue/Introduction

The vpxa management agent on VMware ESX and ESXi 3.5 and newer can be configured to direct their logs to the local syslog daemon in addition to their own local logging in the /var/log/vmware/ directory. In vSphere 4.1, the default configuration includes log messages from the vpxa management agent in syslog, and stores them in the /var/log/messages or /scratch/log/messages log files along with log messages emitted by the VMkernel and other components.

Symptoms:
  • The local /var/log/messages or /scratch/log/messages log file in vSphere ESXi 4.1 may become filled with messages from the vpxa management agent similar to:

    Vpxa: 2010-03-15T13:33:34.856Z [28649B90 verbose 'Default'] [VpxaHalServices] VmGuestDiskChange Event for vm(7) 32

  • The log messages from the hostd and vpxa management services on an ESXi host might fill up the /var/log/messages file. As a result, you might not find sufficient kernel logs to troubleshoot kernel issues.


Resolution

This issue is resolved in ESXi 4.1 Update 2. For more information about this version, see the VMware ESXi 4.1 Update 2 Release Notes. You can download the latest release from the VMware downloads page.

Starting with release ESXi 4.1 Update 2, vpxa and hostd logs are not written to the /var/log/messages file. You can enable this functionality by setting logall=<non zero> in the /etc/syslog.conf file and restarting the syslogd service. For example, to revert to the previous behavior, add the option logall=1 to the /etc/syslog.conf file.

On ESXi 4.1 releases prior to ESXi 4.1 Update 2, the vpxa management agent logs verbosely. If the ESXi host has not been configured to route logs to a remote syslog collector, only the local logs are available. The local messages logs managed by syslog have a maximum size of 8 MB before rotation, which will be exhausted quickly if vpxa log messages are included. This may impair the ability to troubleshoot issues with other components.

To work around this issue on ESXi 4.1 releases prior to ESXi 4.1 Update 2, use one of these options:
  • Configure the ESXi 4.1 host's syslog service to route logs to a remote syslog collector.

    Configure the remote syslog collector split or filter the vpxa and other log messages with an appropriate retention policy for the environment. The local syslog logs in messages contain a mixture of messages from vpxa and other components, and may not be usable for troubleshooting purposes. When troubleshooting issues, review the log messages stored by the remote syslog collector. For more information, see Enabling syslog on ESXi 3.5 and 4.x (1016621).

  • Configure the ESXi 4.1 host's vpxa agent to not emit logs via syslog.

    The local syslog logs in messages will only contain messages from other components. The vpxa management agent stores its own log files in the /var/log/vmware/vpx/ directory, with their own retention and rotation policy. When troubleshooting issues, review the log messages saved locally. For more information, see Configuring syslog logging for hostd and vpxa management agents on ESXi/ESX (1017658).


Additional Information

For more information on the layout and location of logs files in VMware ESXi, see Location of ESXi 3.5-4.1 log files (1021801).

For translated versions of this article, see:

Enabling syslog on ESXi 3.5 and 4.x
Configuring syslog logging for hostd and vpxa management agents on ESXi/ESX
Location of ESXi 3.5-4.1 log files
The vpxa management agent fills local logs in ESXi 4.1
Désactivation de la sortie hostd et vpxa dans le journal /var/log/messages de l'ESXi