Unable to change Syslog.global.auditRecord.storageEnable to true

Products

• VMware vSphere ESXi

Issue/Introduction

When trying to set the advanced setting, 'Syslog.global.auditRecord.storageEnable' to true, you get an error, "A general system error occurred: Internal error when making the change."

If making this change in the ESXi host client you may see an error similar to this below.

Attempting to change this setting via command line using the command, esxcli system auditrecords local enable will likely also fail with this error below. 

The audit record storage directory capacity (4) is smaller than the current capacity (100).

Environment

VMware vSphere ESXi 

Cause

The size of the files in the /scratch/auditLog already exceed the default setting of 4 (in Mib). In this case it will not enable. 

In some cases the existing files are already over the maximum of 100 (in Mib). This will also generate an error if attempting to enable from the command line. 

[root@esxi:/vmfs/volumes/datastore] esxcli system auditrecords local enable
The audit record storage directory capacity (100) is smaller than the current capacity (200).

 

Resolution

Depending on which error you are experiencing you have two options:

• Run this command to increase the size using this command to a value between 4 and 100:
  • esxcli system auditrecords local set --size=<long>         The audit record storage capacity (in MiB). If not specified, 4 is used.
• Create a new directory for auditrecords using this command. For more information see article 370221. 
  • esxcli system auditrecords local set --directory=/scratch/auditLog1   (Note: do not create auditLog1 directory before running this command)