audit.log, access.log, and error.log stop logging on VCSA after log rotation

Products

• VMware vCenter Server 7.0
• VMware vCenter Server 8.0

Issue/Introduction

Due to an issue with syslog, the following files stop writing new log messages after log rotation is triggered:

• /opt/vmware/var/log/lighttpd/access.log

• /opt/vmware/var/log/lighttpd/error.log

• /var/log/audit/audit.log

Resolution

To resolve this issue for the access.log and error.log, edit the following file:

/etc/vmware-syslog/vmware-services-applmgmt.conf

Find the following section:

#vami-access.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/access.log"
Tag="vami-access"
Severity="info"
Facility="local0")
#vami-error.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/error.log"
Tag="vami-error"
Severity="info"
Facility="local0")

Add both options deleteStateOnFileDelete="on" and reopenOnTruncate="on" to the file so it looks like below:

#vami-access.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/access.log"
Tag="vami-access"
Severity="info"
deleteStateOnFileDelete="on"
reopenOnTruncate="on"
Facility="local0")
#vami-error.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/error.log"
Tag="vami-error"
Severity="info"
deleteStateOnFileDelete="on"
reopenOnTruncate="on"
Facility="local0")

Save and close the file.

To resolve this issue for the audit.log, edit the following file:

/etc/vmware-syslog/vmware-services-cloudvm.conf

Find the following section:

#vcsa-audit
input(type="imfile"
File="/var/log/audit/audit.log"
Tag="vcsa-audit"
Severity="info"
Facility="local0")

Add both options deleteStateOnFileDelete="on" and reopenOnTruncate="on" to the file so it looks like below:

#vcsa-audit
input(type="imfile"
File="/var/log/audit/audit.log"
Tag="vcsa-audit"
Severity="info"
deleteStateOnFileDelete="on"
reopenOnTruncate="on"
Facility="local0")

Save and close the file.