vSphere replication sending too many logs to Syslog server

Products

• VMware Live Recovery

Issue/Introduction

After upgrading ESXI hosts to 8.0u2 or above, vSphere replication is sending too many "Info" Logs to syslog server.

Environment

vSphere replication 9.X
ESXI 8.0u2 and up

Cause

ESXI 8.0 U2 introduces the replication server installed directly on the ESXI host. Because of this, the Replication appliance is streaming a lot of successful connection attempts in the logs. 

Resolution

Set hbrsrv to only send error logs to Syslog server.

1. Snapshot the vSphere replication appliance
2. SSH and sudo root account.
3. Make a copy of the hbrsrv configuration file

cp /etc/vmware/hbrsrv.xml /etc/vmware/hbrsrv.orig

4.Stop hbrsrv service

service hbrsrv stop

 

5.Edit the file and change the line <syslogLevel>info</syslogLevel> to <syslogLevel>error<syslogLevel>

6. Start hbrsrv service

service hbrsrv service

7. Verify in syslog server after a few minutes to ensure that logs from hbrsrv service on vSphere replication are only showing error logging and above. 

Additional Information

This will only make a change to the logs that are imported into the syslog server. The hbrsrv.log will continue to log all levels.