Spew/Spam of PropertyCollector events in syslog server from ESXi hosts

Products

• VMware vSphere ESXi

Issue/Introduction

>A large amount of events are being reported in syslog servers from ESXi hosts such as below:

Apr 24, 2024 11:01:51.528 2024-04-24T09:01:51.042Z <ESXI_FQDN> Hostd[******]: [api.call@6876 subject="vpxuser" object="vmodl.query.PropertyCollector:ha-property-collector:vmodl.query.PropertyCollector.waitForUpdatesEx" result="success"]

>Other events such as VM performance/stats queries can also occur

>Little to no events with the same method in /var/log/hostd.log

Environment

ESXi 8.0 

Configured syslog server such as Aria Operations, Log Insight etc

Cause

These api.call events are constant queries run on the ESXi every few seconds - the queries themselves are expected behaviour, but syslog interprets them as events to be sent to the syslog server.

Resolution

Fixed in ESXi 8.0 U3.

A new advanced setting on the ESXi host is present and disabled by default - UserVars.AuditApiCallEnabled

When the advanced setting is disabled; these api.call events are no longer sent to the syslog server. No other events are affected.

The advanced setting can be enabled if needed for any syslog audits and then disabled when no longer required.