vCenter Server /Storage/log at 100% When Remote Syslog Configured for vCenter through Appliance Manager

Products

• VMware vCenter Server

Issue/Introduction

- Backups may stop completing successfully through the VAMI of vCenter Server

- /Storage/log/vmware/esx/VC-Name gets filled up with syslog and syslog.backup files consistently, even after clean up operations performed 

- In the VAMI UI under "Syslog" configuration for remote syslog doesn't show connected and may show status as "Unknown"

Environment

vCenter Server 7.0 

vCenter Server 8.0 

Cause

Due to a broken syslog configuration for vCenter, influx of logs caused the /storage/log/vmware/esx/VC-Name to get full with remote syslog files constantly 

Resolution

Ensure to have valid snapshots/backups completed of the vCenter environment (offline snapshots of all vCenters in enhanced linked mode) prior to implementing any changes 

 

1. Navigate to the Appliance Management Page of the vCenter Server, navigate to the "Syslog" tab, take note of the Syslog configurations and delete the current invalid Remote Syslog Configuration

2. Log into the vCenter Server through SSH as root and clean up the affected directory with the large Syslog file, see following KB for steps on this: vCenter log disk exhaustion or /storage/log full

3. Reconfigure the remote syslog for vCenter by following article: Forward vCenter Server Log Files to Remote Syslog Server

Additional Information

Similar Issues for ESXi Remote Syslog: /storage/log running full in VCSA when using it as a remote syslog collector for the ESXi hosts in the environment