The /var/log/wtmp file grows rapidly and fills the ramdisk of the ESXi host

Products

• VMware

Issue/Introduction

Symptoms:

• Adding a virtual machine from a datastore fails.
• You see the error:
  
  invalid VM
  
  
• The var/log/vobd.log file contains entries similar to:
  
  vobd.log:2012-02-01T11:16:28.798Z: [VisorfsCorrelator] 4132132662503us: [vob.visorfs.ramdisk.full] Cannot extend visorfs file /var/log/wtmp because its ramdisk (root) is full.
  
  

Cause

This issue occurs because of large number of log in attempts to the ESXi host causing the /var/log/wtmp file to grow and consume 100% of root ramdisk.

Resolution

This issue is resolved in ESXi 5.0 Update 2. Download ESXi 5.0 Update 2 or later, available at VMware Downloads.

To work around this issue, remove and recreate the wtmp file.

To remove and recreate the wtmp file:

1. Connect to the ESXi host directly using a Secure Shell (SSH). For more information, see Using Tech Support Mode in ESXi 4.1 and ESXi 5.x (1017910).
2. Run these commands:
   
   rm /var/log/wtmp
   touch /scratch/log/wtmp
   ln -s /scratch/log/wtmp /var/log/wtmp
   
   
3. Restart the Management agents. For more information, see Restarting the Management agents on an ESXi or ESX host (1003490).
4. To ensure that the changes persist after rebooting the host:

1. Open the /etc/rc.local file using a text editor.
2. Add these entries to the file:
   
   rm /var/log/wtmp
   touch /scratch/log/wtmp
   ln -s /scratch/log/wtmp /var/log/wtmp
   
   
3. Save and close the file.

Additional Information

To be alerted when this document is updated, click the Subscribe to Article link in the Actions box

Restarting the Management agents in ESXi
Using Tech Support Mode in ESXi 4.1, ESXi 5.x, and ESXi 6.x
/var/log/wtmp ファイルのサイズが急速に増え ESXi ホストの RAM ディスクを占有する
/var/log/wtmp 文件迅速增长并填满 ESXi 主机的 ramdisk