Error: rsyslogd imfile message received is larger than max msg size in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

In a vCenter Server environment, the following log is frequently forwarded to remote syslog servers or local logs (like /var/log/messages) 

YYYY-MM-DDTHH:MM:SS rsyslogd: imfile error: message received is larger than max msg size; message will be split and processed as another message v8.2001.0 try https://www.rsyslog.com/e/2175

 

Environment

VMware vCenter Server 7.0
VMware vCenter Server 8.0

Cause

This logging occurs when a single log message exceeds the maximum message size configured for rsyslog. The imfile module streams log messages, and when a line is too long, rsyslog splits the message into data chunks to prevent data loss. The error is a standard notification of this message fragmentation process by rsyslog.

Resolution

 These messages indicate normal system behavior and can be ignored. To suppress them:

1. Log in to the vCenter Server Appliance via SSH as the root user.

2. Backup configuration: mkdir /root/syslog-bak && cp /etc/vmware-syslog/*.conf /root/syslog-bak/

3. Edit the configuration files located in the /etc/vmware-syslog/ directory.

4. Add the parameters discardTruncatedMsg="on" and msgDiscardingError="off" to each input type="imfile" section.
   
   Example configuration:

   input(type="imfile"
   
   discardTruncatedMsg="on"
   msgDiscardingError="off"
   
   )

5. Restart the rsyslog service to apply the changes using the following command:
   
   systemctl restart rsyslog

Additional Information

Japanese version: vCenter Server の syslog に imfile error message received is larger than max msg size が頻発する(436762)