Invalid system log directory

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

You receive this event when the host is unable to write log files to the configured system log directory, and instead uses the default log directory. This can occur if the host does not have permission to write to the directory (for example, a NAS filesystem which is exported read-only), or if the host is completely unable to access the filesystem.

Example

A problem event appears in the vSphere Client with the following message:

The configured log directory /vmfs/volumes/########-#### cannot be used. The default directory /scratch/log will be used instead.

Impact

Logs are written to the host's local scratch partition for ESXi, or stored in RAM for a host provisioned with Auto-Deploy, rather than to the desired log directory.

Resolution

1. Determine the cause of the failure and correct either the host's logging configuration or the storage system's configuration (for example, NAS export permissions or SAN zoning), as appropriate.
   
   Detailed information might be found in /var/log/.vmsyslogd.err.
   Note that /var/log itself is no longer a valid log storage location in this condition.
    
2. Once the failure has been addressed, or the logging location has been changed (see "Additional Information" links below for more information), reload the system logger using the following command:
   # esxcli system syslog reload

Additional Information

• Determining whether an ESXi host has persistent logging (2004773)
• System logs are stored on non-persistent storage (2032823)
• Creating a persistent scratch location for ESXi 4.x/5.x/6.x (1033696)
• Manually setting a scratch location for ESXi in the vSphere Client appears to succeed but the setting is not honored (2003678)
• Advanced setting "ScratchConfig.ConfiguredScratchLocation" for persistent scratch location is reverted to the default value after ESXi 6.x host reboot (2151270)
• Configuring syslog on ESXi (2003322)