Syslog in vCenter Server transfers a large number of logs at once

Products

• VMware vCenter Server

Issue/Introduction

• The volume of logs forwarded by Syslog temporarily rises sharply
• Forwarded logs are from previous days, and their contents are considered as retransmission.
• Certain logs (e.g. sca-vmon.std, vstats) are being transferred to syslog all at once.

Environment

vCenter Server 7.x
vCenter Server 8.x

Cause

The title of the new log file or temporary file created as a result of log rotation matches the transfer criteria.

Resolution

This is a known issue. The fix will be available in a future release. 

Workaround:

Manually change the syslog transfer setting.

1. Connect to vCenter Server via SSH.
   
   
2. Move to /etc/vmware-syslog.
   cd /etc/vmware-syslog
   
   
3. Back up the file to be modified or take a snapshot of a powered-off vCenter Server and revise the file as follows.
   
   vmware-services-vstats.conf
   ## Before
   #vstats log
   input(type="imfile"
         File="/var/log/vmware/vstats/vstats-std*.log"
         Tag="vstats"
         Severity="info"
         Facility="local0")
   
   ## After
   #vstats log
   input(type="imfile"
         File="/var/log/vmware/vstats/vstats-stdout.log"
         Tag="vstats"
         Severity="info"
         Facility="local0")
   input(type="imfile"
         File="/var/log/vmware/vstats/vstats-stderr.log"
         Tag="vstats"
         Severity="info"
       Facility="local0")
   
   vmware-services-sca.conf 
   ## Before
   #sca
   input(type="imfile"
         File="/var/log/vmware/sca/sca.log"
         Tag="sca"
         Severity="info"
         Facility="local0")
   #sca-gc
   input(type="imfile"
         File="/var/log/vmware/sca/sca-gc.log.*.current"
         Tag="sca-gc"
         Severity="info"
         Facility="local0")
   #vmon.std
   input(type="imfile"
         File="/var/log/vmware/sca/vmon.std*"
         Tag="sca-vmon.std"
         Severity="info"
         Facility="local0")
   
   ## After
   #sca
   input(type="imfile"
         File="/var/log/vmware/sca/sca.log"
         Tag="sca"
         Severity="info"
         Facility="local0")
   #sca-gc
   input(type="imfile"
         File="/var/log/vmware/sca/sca-gc.log.*.current"
         Tag="sca-gc"
         Severity="info"
         Facility="local0")
   #vmon.std
   input(type="imfile"
       File="/var/log/vmware/sca/vmon.stderr"
         Tag="sca-vmon.std"
         Severity="info"
         Facility="local0")
   input(type="imfile"
       File="/var/log/vmware/sca/vmon.stdout"
         Tag="sca-vmon.std"
         Severity="info"
         Facility="local0")
   
   
4. restart rsyslog service
   
   systemctl restart rsyslog