Exported ESXi system log bundle contains empty /var/run/logs directory

Products

• VMware vCenter Server
• VMware vSphere ESX 8.x

Issue/Introduction

When exporting a system log bundle (vm-support) from a VMware ESXi host, the /var/run/logs directory within the extracted archive is found to be empty. The expected host log files are missing from the exported support bundle. Other errors that the customer sees would be:

1. Attempts to view logs via SSH (e.g., using cat or less on /var/run/log/hostd.log) result in the error: Device or resource busy.

2. The vSphere Client may display a warning: Logging to storage has failed. Logs are no longer being stored locally on this host.

3. The log file /var/log/.vmsyslogd.err contains entries indicating storage logging failures.

Environment

VMware ESXi (All supported versions)
VMware vCenter Server (All supported versions)

Cause

The Advanced System Setting Syslog.global.logDirUnique on the ESXi host is set to false, while Syslog.global.logDir is configured to route logs to a shared datastore. When the unique host subdirectory flag is disabled, the vm-support log collection utility fails to locate, isolate, and accurately map the remotely stored logs back into the /var/run/logs path of the generated support bundle.

Resolution

Modify the Syslog.global.logDirUnique setting to true to ensure the ESXi host creates a host-specific subdirectory for its syslog data.

1. Log in to the vSphere Client using administrative credentials.

2. Navigate to Hosts and Clusters and select the affected ESXi host.

3. Select the Configure tab.

4. Under the System section, select Advanced System Settings.

5. Click Edit.

6. In the filter box, type Syslog.global.logDirUnique to locate the setting.

7. Modify the value from false to true.

8. Click OK to save the configuration.

Before making the above change on an ESXi host, place the host in Maintenance mode. 

Additional Information

Configuring Syslog.global.logDirUnique to true is a best practice when configuring multiple ESXi hosts to send their logs to a centralized shared datastore. It prevents file lock contention, log overlapping, and ensures log collection tools function properly.

If the "Device or resource busy" error persists, identify which host is holding the lock on the log file:

1. Log in to the host via SSH.
2. Run the command: vmkfstools -D /vmfs/volumes/[DatastoreName]/[PathToLogs]/hostd.log
3. Locate the MAC address in the "owner" field of the output.
4. In the vSphere Client, go to Host > Configure > Networking > Physical adapters for other hosts in the cluster to find the matching MAC address. That host is the one currently locking the shared log file.