Procstate file growth caused by permission settings in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

In vCenter Server environments, the /var/log/vmware/procstate file may grow excessively and potentially consume disk space. When this issue occurs, the system log records the following error, indicating that logrotate skipped processing due to insecure parent directory permissions.

YYYY-MM-DDTHH:MM:SS <hostname> logrotate: error: skipping /var/log/vmware/procstate because parent directory has insecure permissions It's world writable or writable by group which is not root Set su directive in config file to tell logrotate which user/group should be used for rotation.

Environment

VMware vCenter Server

Cause

The logrotate utility is designed to skip rotation for directories with overly permissive write access (such as 777) for security reasons. To verify if this condition is met, run the following command:

Example
root@vcsa [ ~ ]# ls -ld /storage/log/vmware
drwxrwxrwx 67 root root 4096 Apr 16 09:00 /storage/log/vmware

If the output shows a world-writable state like 777, it matches the criteria for the logrotate error. This permissive setting is inferred to be a factor causing the issue, though the root cause for the permission change may involve various factors including product behavior or specific configurations.

Resolution

To resolve the issue, follow these steps:

1. Clear the overgrown file content to reclaim disk space immediately. These operations do not impact system behavior.
   truncate -s 0 /var/log/vmware/procstate

2. Change the directory permissions to a secure state (such as 755) to address the trigger for the logrotate error.
   chmod 755 /storage/log/vmware

Additional Information

Japanese version: vCenter Server における権限設定に起因する procstate ファイルの肥大化について(437124)