/storage/log filling up with imfile-state files | rsyslogd

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

/storage/log is filling up and there are many files in the /var/log/vmware/rsyslogd directory. You may or may not be able to list the contents of /var/log/vmware/rsyslogd/.

Environment

VMware vCenter Server 7.0.x

Cause

The imfile-state:XXXX files are created due to the rsyslog daemon's method of tracking messages that have already been sent to the syslog server.

Resolution

To resolve this issue, create a cron job to clear these files.

1. Stop rsyslog

systemctl stop syslog.socket rsyslog.service

2. Verify that the service is stopped

ps aux | grep rsyslogd

3. Verify in /var/run that rsyslogd.pid does not exist
4. Create a directory for the cron job

cd ~
mkdir syslogcron
cd syslogcron/

5. Create a file called cleanimf.sh and save it with contents below.

vi cleanimf.sh

#!/bin/bash
find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}

6. After saving the file (by typing ':wq'), apply permissions to the file

chmod 755 cleanimf.sh

7. Create a cron job to execute the script every hour (remember to save the file with ':wq')

cd /etc/cron.d

vi cleanimf.cron

0 * * * * root /root/syslogcron/cleanimf.sh 2>&1

8. Start the rsyslog daemon

systemctl start syslog.socket rsyslog.service

Additional Information

To remove all the files immediately (before creating the cron job), run the following command and wait until it finishes:

find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}

/storage/log が imfile-state ファイルでいっぱいになる | rsyslogd