External syslog collector misinterprets host name information in postgres_archiver logs

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:
When using a 3rd party syslog collector application, the string "DEBUG_pb_archiver" or a part of it might be interpreted as a the vCenter name by certain syslog collector applications.
This can lead to issues in the external application, e.g. when its configured to create folder for each of the systems it collects the logs of, it might create a new folder specifically for these log entries.

Environment

VMware vCenter Server 7.0.x

Cause

The postgres archiver logs aren't meant to be sent to an external collector, hence the log stream sent might not be formatted in a way that the syslog collector understands and handles properly

Resolution

Currently there is no solution for this behavior.

Workaround:
As a workaround, the external syslog collector should be configured to filter the postgres_archiver logs out. If this is not possible, a similar filter can be configured in the rsyslogd component on the vCenter Server Appliance. To do this, apply the following steps:

1. create a backup of the current rsyslogd configuration:

   # cp /etc/rsyslog.conf /etc/rsyslog.conf.bak

2. edit the /etc/rsyslog.conf file and, before the line "# ESX rules" insert the following lines:

   :msg, contains, "pg_archiver" ~
   & stop

3. to apply this configuration, restart the remote syslog daemon by running:

   # systemctl restart rsyslog