Frequent messages such as vmsyslog logger :514 lost xxxxxx log messages, with no Remote syslog configured on the ESXi host

Products

• VMware vSphere ESXi
• VMware vSphere ESXi 6.0
• VMware vSphere ESXi 7.0
• VMware vSphere ESXi 8.0

Issue/Introduction

- Though remote syslog server is not configured on the ESXi host,  a flood of messages stating "vmsyslog logger :514 lost xxxxxx log messages" is observed in syslog.log

- Executing command "esxcli system syslog config get"  on ESXi doesn't point to any remote syslog server

Cause

• Stale configuration with an empty remote server address present in the syslog configuration file.
• Below is a sample syslog configuration file with stale/empty entries
  • cat etc/vmsyslog.conf

  • [DEFAULT]
    audit_record_threads_per_socket=2
    drop_log_rotate=10
    rotate=8
    default_timeout=180
    enable_logfilters=false
    drop_log_size_kb=100
    audit_log_capacity=0
    logdir_unique=false
    x509_strict=false
    crl_check=false
    vsan_backing=false
    queue_drop_mark=90
    check_ssl_certs=true
    logdir=/scratch/log
    remote_host_max_msg_len=1024
    size=1024
    loghost=<none>
    audit_log_remote=false
    audit_log_dir=/scratch/auditLog
    standard_message_threads_per_socket=2
    audit_log_local=false
    standard_message_memory_pool_size=40
    audit_record_memory_pool_size=1
    [vmsyslog]
    audit_record_memory_pool_size=1
    loghost=
    enable_logfilters=false

• Below is the sample configuration file for server with no remote syslog configuration
• • cat etc/vmsyslog.conf

  • [DEFAULT]
    audit_record_threads_per_socket=2
    drop_log_rotate=10
    rotate=8
    default_timeout=180
    enable_logfilters=false
    drop_log_size_kb=100
    audit_log_capacity=0
    logdir_unique=false
    x509_strict=false
    crl_check=false
    vsan_backing=false
    queue_drop_mark=90
    check_ssl_certs=true
    logdir=/scratch/log
    remote_host_max_msg_len=1024
    size=1024
    loghost=<none>
    audit_log_remote=false
    audit_log_dir=/scratch/auditLog
    standard_message_threads_per_socket=2
    audit_log_local=false
    standard_message_memory_pool_size=40
    audit_record_memory_pool_size=1
    [vmsyslog]

Resolution

Resolution:

Remove the stale entries from the vmsyslog.conf file

1. Copy or take backup the config file:

   • cp /etc/vmsyslog.conf /etc/vmsyslog.orig

2. Edit the file and remove the 3 lines at the end:

   • vi /etc/vmsyslog.conf

   • audit_record_memory_pool_size=1
     loghost=
     enable_logfilters=false

3. Reload the syslog daemon:

   • esxcli system syslog reload