Exported ESXi system log bundle contains empty /var/run/logs directory

Products

• VMware vCenter Server
• VMware vSphere ESX 8.x

Issue/Introduction

When exporting a system log bundle (vm-support) from a VMware ESXi host, the /var/run/logs directory within the extracted archive is found to be empty. The expected host log files are missing from the exported support bundle.

Environment

VMware ESXi (All supported versions)
VMware vCenter Server (All supported versions)

Cause

The Advanced System Setting Syslog.global.logDirUnique on the ESXi host is set to false, while Syslog.global.logDir is configured to route logs to a shared datastore. When the unique host subdirectory flag is disabled, the vm-support log collection utility fails to locate, isolate, and accurately map the remotely stored logs back into the /var/run/logs path of the generated support bundle.

Resolution

Modify the Syslog.global.logDirUnique setting to true to ensure the ESXi host creates a host-specific subdirectory for its syslog data.

1. Log in to the vSphere Client using administrative credentials.

2. Navigate to Hosts and Clusters and select the affected ESXi host.

3. Select the Configure tab.

4. Under the System section, select Advanced System Settings.

5. Click Edit.

6. In the filter box, type Syslog.global.logDirUnique to locate the setting.

7. Modify the value from false to true.

8. Click OK to save the configuration.

Before making the above change on an ESXi host, place the host in Maintenance mode. 

Additional Information

Configuring Syslog.global.logDirUnique to true is a best practice when configuring multiple ESXi hosts to send their logs to a centralized shared datastore. It prevents file lock contention, log overlapping, and ensures log collection tools function properly.