Syslog server filling up with log files

Products

• VMware vSphere ESXi
• VMware vSphere ESXi 7.0

Issue/Introduction

The log filtering capability lets you modify the logging policy of the syslog service that is running on an ESXi host.

Cause

Frequent alerts on the syslog servers

Resolution

To forward only the filtered logging to the syslog server
 
enable_logfilters = false needs to be changed to enable_logfilters = true

Steps:         

1. Take backup of the vmsyslog.conf  "cp vmsyslog.conf vmsyslog.conf.bck"
2. Edit vmsyslog.conf using VI editor
3. Press i to change to insert mode
4. Change this value to true "enable_logfilters = true"
5. Press Esc key to exit insert mode and to Save the file :wq!    

Example: Commands for the logs that need to be filtered as per requirement

          esxcli system syslog config logfilter add --filter="0|Vpxa|info vpxa"
     esxcli system syslog config logfilter add --filter="1|Vpxa|info vpxa"
     esxcli system syslog config logfilter add --filter="1|vpxa|info vpxa"
     esxcli system syslog config logfilter add --filter="0|vpxa|info vpxa"
     esxcli system syslog config logfilter add --filter="0|Fdm|verbose fdm"
     esxcli system syslog config logfilter add --filter="1|Fdm|verbose fdm"
     esxcli system syslog config logfilter add --filter="1|fdm|verbose fdm"
     esxcli system syslog config logfilter add --filter="0|fdm|verbose fdm"
     esxcli system syslog config logfilter add --filter="0|Rhttpproxy|verbose rhttpproxy"
     esxcli system syslog config logfilter add --filter="1|Rhttpproxy|verbose rhttpproxy"
     esxcli system syslog config logfilter add --filter="1|rhttpproxy|verbose rhttpproxy"
     esxcli system syslog config logfilter add --filter="0|rhttpproxy|verbose rhttpproxy"
     esxcli system syslog config logfilter add --filter="0|Fdm|info fdm"
     esxcli system syslog config logfilter add --filter="1|Fdm|info fdm"
     esxcli system syslog config logfilter add --filter="1|fdm|info fdm"
     esxcli system syslog config logfilter add --filter="0|fdm|info fdm"

Run the below commands to check the filters
esxcli system syslog config logfilter list
esxcli system syslog reload

Additional Information

Please refer to these articles 

ESXi Installation and Setup

Configuring syslog on ESXi