ESXi hosts fails to send logs to syslog server

Products

• VMware vSphere ESXi

Issue/Introduction

Host events tab reports errors similar to: "The host "syslogserver.fqdn.net:1514" has become unreachable. Remote logging to this host has stopped."

In /var/run/log/vobd.log, you see similar errors: 
YYYY-MM-DDTHH:MM:SS.052Z: [VisorfsCorrelator] 21909419360842us: [esx.problem.visorfs.ramdisk.full] The ramdisk 'tmp' is full. As a result, the file tmp:/scratch/log/vpxa.log could not be written.
YYYY-MM-DDTHH:MM:SS.987Z: [GenericCorrelator] 21966169295242us: [vob.user.vmsyslogd.remote.failure] The host "syslogserver.fqdn.net:1514 has become unreachable. Remote logging to this host has stopped.

In  /var/log/.vmsyslogd.err, you see similar errors: 
YYYY-MM-DDTHH:MM:SS.712Z vmsyslog.loggers.file : ERROR ] Write to /scratch/log/vmkernel.log failed: No space left on device
YYYY-MM-DDTHH:MM:SS.713Z vmsyslog.main : ERROR ] <vmkernel> failed to write log, disabling
YYYY-MM-DDTHH:MM:SS.825Z vmsyslog.loggers.network : ERROR ] syslogserver.fqdn.net:1514 - socket error : The write operation timed out

Environment

VMware vSphere ESXi 6.x 
VMware vSphere ESXi 7.x

 

Cause

This issue is caused by the scratch partition being full.

Resolution

If the error was caused by an administrator action (i.e. a user has placed a file manually on the scratch partition), delete the files that use the incorrect path or move them to a datastore. 

 

Additional Information

Impact/Risks:
Low impact