Syslog server is spammed with Envoy logs

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• Syslog server is spammed with Envoy logs
• Syslog server storage is full
• vCSA /var/log/vmware/envoy is full of envoy-access.log

Environment

• VMware vCenter Server 7.0.x

Cause

Envoy-access.log size depends on how many external and internal requests the vCenter has to process. Envoy logs each request to the vCenter and on the vCenter.

At this time, configuration changes to the Envoy access logs are unsupported.  We cannot change the size of the messages or the count of the messages.

Resolution

Workaround:

As a workaround, we suggest stopping the forwarding of the envoy access logs to rsyslog on vCenter. This will allow the envoy access logs to still be created locally on vCenter; only the envoy access logs will be stopped from being forward to the syslog server with this change.

To stop the forwarding of the envoy access logs to rsyslog on vCenter:

1. SSH to vCSA via root
2. mv /etc/vmware-syslog/vmware-services-envoy.conf /etc/vmware-syslog/vmware-services-envoy.conf.disabled
3. Reboot the vCSA

Envoy-access.log will continue to write to the local file.


To revert the changes:

1. SSH to vCSA via root
2. mv /etc/vmware-syslog/vmware-services-envoy.conf.disabled /etc/vmware-syslog/vmware-services-envoy.conf
3. Reboot the vCSA