vCenter Server syslog shows frequent imfile error message received is larger than max msg size messages
Article ID: 436763
Updated On:
Products
Issue/Introduction
In a vCenter Server environment, excessive noise is forwarded to the remote syslog server or local log files. The following message appears repeatedly every few minutes:
YYYY-MM-DDTHH:MM:SS rsyslogd: imfile error: message received is larger than max msg size; message will be split and processed as another message v8.2001.0 try https://www.rsyslog.com/e/2175
Environment
VMware vCenter Server 7.0
VMware vCenter Server 8.0
Cause
This logging occurs when a single log message exceeds the maximum message size configured for rsyslog. The imfile module streams log messages, and when a line is too long, rsyslog splits the message into data chunks to prevent data loss. The error is a standard notification of this message fragmentation process by rsyslog.
Resolution
Basically, these messages indicate normal system behavior and can be safely ignored. However, if you still want to suppress them because they are being sent in large volumes, consider applying the following settings.
Log in to the vCenter Server Appliance via SSH as the root user.
Edit the configuration files located in the /etc/vmware-syslog/ directory.
Add the parameters discardTruncatedMsg="on" and msgDiscardingError="off" to each input type="imfile" section.
Example configuration
input(type="imfile"
discardTruncatedMsg="on"
msgDiscardingError="off"
)
Restart the rsyslog service to apply the changes using the following command:
systemctl restart rsyslog
Additional Information
Feedback
