Redirecting vSAN trace-level messages to a syslog server

Products

• VMware vSAN

Issue/Introduction

This article explains the vSAN trace-level logging and the options to configure vSAN traces.

 

For vSAN 6.2 and later, some of the trace-level logging created by vSAN can be forwarded to a syslog server. The total volume of traces is too great for syslog handling, but the urgent traces (provides details on most potentially-significant problems) can be forwarded to an external syslog collector. The use of syslog redirection for the urgent traces is a useful troubleshooting tool, as it can permit the evaluation of trace data even if the traces are lost.

Symptoms:

If not planned or incorrectly configured, vSAN trace-level messages may be:

• Taking up a lot of space on ESXi hosts running from a RAM disk
• Written to non persistent storage

Environment

VMware vSAN 6.7.x
VMware vSAN 6.2.x
VMware vSAN 6.6.x
VMware vSAN 7.0.x
VMware vSAN 8.0.x
VMware vSAN 6.5.x

Resolution

By default, vSAN traces are saved to /var/log/vsantraces. Default maximum file size is 180MB with rotation of 8 files.

 

By default, vSAN urgent traces are redirected through the ESXi syslog system. If an external syslog server is defined, the urgent traces are forwarded to the external collector. For more information on examining the syslog configuration or redirecting ESXi host logs to an external syslog server, see Configuring syslog on ESXi 5.x and 6.0 (2003322).

Run this command to determine whether vSAN urgent traces are currently configured to redirect through syslog and log rotation settings:

 

# esxcli vsan trace get

 

You see output similar to:

VSAN Traces Directory: /vmfs/volumes/568ec568-06d68562-e655-001018ed2950/scratch/vsantraces

Number Of Files To Rotate: 8
Maximum Trace File Size: 180 MB
Log Urgent Traces To Syslog: true

Run this command to send urgent traces through syslog

# esxcli vsan trace set --logtosyslog true

 

 

Additional Information

To change the default settings, run with the desired parameter:

 

# esxcli vsan trace set

 

-l|--logtosyslog Boolean value to enable or disable logging urgent traces to syslog.

-f|--numfiles=<long> Log file rotation for vSAN trace files.

-p|--path=<str> Path to store vSAN trace files.

-r|--reset When set to true, reset defaults for vSAN trace files.

-s|--size=<long> Maximum size of vSAN trace files in MB.

 

For example, to reduce the number of files to rotate to 4 and maximum size to which these files can grow 200MB, run this command:

 

# esxcli vsan trace set -f 4 -s 200

 

Note: If you reduce the number of files, the older files that are not compliant are removed immediately.

 

Configuring syslog on ESXi
将 vSAN 跟踪级别消息重定向到 syslog 服务器