Missing /var/run/log Directory in ESXi Log Bundles on NFS Storage

Products

• VMware vSphere ESXi

Issue/Introduction

• When generating an ESXi host log bundle (vm-support), the process completes without explicit errors, but the resulting archive is incomplete.
• Upon extracting and inspecting the log bundle archive, the

 

Environment

VMware ESXi 8.x

Storage: External NFS storage configured for the ESXi host log partition.

 

Cause

This issue occurs due to a conflict between the external NFS server's permission configuration and the security mechanisms built into the ESXi log collection script.

Specifically, the external NFS storage system is configured to enable the executable permission bit (e.g., +x) on all hosted log files. The ESXi vm-support script includes a security measure designed to explicitly exclude any files that have the executable bit set. Because the NFS server enforces this permission bit on the log files, the collection script safely bypasses them, resulting in the /var/run/log directory being omitted from the final bundle.

Resolution

To resolve this issue, contact your storage team to modify the permission handling on the external NFS server so that log files are not made executable.