Alarm 'Host error' with 'Issue detected on ##### in ha-datacenter: vmsyslog logger ###.###.###.### lost #### log messages'
search cancel

Alarm 'Host error' with 'Issue detected on ##### in ha-datacenter: vmsyslog logger ###.###.###.### lost #### log messages'

book

Article ID: 415811

calendar_today

Updated On:

Products

VMware vSphere ESXi 8.0

Issue/Introduction

  • This alarm is notified from vCenter Server every 12 hours.

Alarm 'Host error' on <ESXi hostname> triggered by event ######## 'Issue detected on <ESXi hostname> in Datacenter: vmsyslog logger <Remote syslog server IP address> lost ### log messages

 

  • There are no issues with connectivity between ESXi and the remote syslog server.

 

  • In ESXi /var/run/log/vmsyslogd-dropped.log, you may see that events like the following are repeatedly recorded:

YYYY-MM-DDTHH:MM:SS.SSSZ: YYYY-MM-DDTHH:MM:SS.SSSZ cpu43:723986427)Admission failure in path: host/vim/vmvisor/nsx-exporter:python.########:uw.########
YYYY-MM-DDTHH:MM:SS.SSSZ: YYYY-MM-DDTHH:MM:SS.SSSZ cpu43:723986427)started from 'nsx-exporter' ######## with cmdline '/usr/lib64/vmware/nsx-exporter/nsx-exporter', parent ########
YYYY-MM-DDTHH:MM:SS.SSSZ: YYYY-MM-DDTHH:MM:SS.SSSZ cpu43:723986427)started from 'sh' ######## with cmdline '/bin/sh /sbin/watchdog.sh -s NSX_EXPORTER -q 20 /usr/lib64/vmware/nsx-exporter/nsx-exporter ++securitydom=43', parent ########
YYYY-MM-DDTHH:MM:SS.SSSZ: YYYY-MM-DDTHH:MM:SS.SSSZ cpu43:723986427)started from 'init' ######## with cmdline '/bin/init', parent 0
YYYY-MM-DDTHH:MM:SS.SSSZ: YYYY-MM-DDTHH:MM:SS.SSSZ cpu43:723986427)uw.######## (########) requires ### KB, asked ### KB from nsx-exporter (########) which has ######## KB occupied and ### KB available.

Messages that failed to be transmitted are written to this file.

Environment

VMware vSphere ESXi 8.0

Cause

In this case, due to a known issue with NSX, excessive logging causes the logger buffer to fill up and preventing logs from being transmitted to the syslog server.
NSX Application Platform Communication Errors and Application Crash Due to OOM (Out of Memory)

Resolution

By addressing the issue according to the KB resolution mentioned above, you can reduce the number of log events and suppress the alarm.

Additional Information

The first step in troubleshooting this alarm is to verify the correct configuration and check connectivity between the host and the syslog server.

Additionally, excessive events may be logged due to other factors such as hardware failures. Please check the vmsyslogd-dropped.log to see what types of events are being dropped.

 

Powered by Wolken Software