VCSA /storage/log directory full due to syslog collector log files

Products

• VMware vCenter Server

Issue/Introduction

• /storage/log partition is full with very large *syslog.log files

 

Environment

• vCenter Server 6.5 or newer.
• The ESXi hosts may have just been pointed to the vCenter server Appliance Syslog collector.

 

Cause

• Under some circumstances, the rsyslog service fails to read from the /etc/logrotate.d/vmware-syslog.lr file following a syslog collector change.

Resolution

1. Log in to the vCenter Server Appliance as the root user.
2. Take a backup of the /etc/logrotate.d/vmware-syslog.lr
 

cp /etc/logrotate.d/vmware-syslog.lr etc/logrotate.d/vmware-syslog.lr.bak
 

3. Open the vmware-syslog.lr file using a text editor, such as vi. The file contains the following information:

/var/log/vmware/*/*-syslog.log
/var/log/vmware/esx/*/*-syslog.log
{
su root root
nodateext
rotate 15
missingok
notifempty
size 5M
compress
create 640 root root
sharedscripts
postrotate
/usr/bin/systemctl reload syslog.service > /dev/null
endscript
}

4. You can change the amount of files being saved (rotate x) and the size (size xM). To calculate the amount of space the logs will take multiply <Number of Hosts>*rotate*size.

5. Restart the syslog service:

systemctl restart rsyslog