vSAN online health alarm 'ESXi system logs stored outside vSAN datastore'

Products

• VMware vCenter Server

Issue/Introduction

The vSAN Skyline Health reports an active alarm.

The vSAN Skyline Health alarm shows, "vSAN online health alarm 'ESXi system logs stored outside vSAN datastore'".

Environment

VMware vSAN (All Versions)

Cause

This alarm will be triggered if the ESXi syslog or scratch partition is stored on a vSAN datastore.  This can cause the ESXi host to become unresponsive in the VMware vCenter and the host CLI. 

Resolution

Reconfigure the scratch location or the syslog location to be outside of the vSAN datastore. 

The syslog reconfiguration does not require host reboot.  It only requires the syslog service to be restarted.  Use the following command on the individual ESXi hosts to restart the service.

esxcli system syslog reload

To update the scratch location configuration a host reboot is required. 

Additional Information

System logs are stored on non-persistent storage

Redirecting system logs to a vSAN object causes an ESXi host lock up