High log volume with DOMTraceCompSchedQueueStats entries in Aria Operations for Logs

Products

• VMware vSAN

Issue/Introduction

Aria Operations for logs receives a massive influx of  DOMTraceCompSchedQueueStats events from ESXi host. These events are primarily informational vSAN traces that do not indicate a functional failure but can saturate syslog buffers and storage.

Environment

• VMware vSphere ESXi 8.x
• VMware vSAN 8.x
• Aria Operations

Cause

The high log volume is caused by the automated collection and forwarding of vSAN Distributed Object Manager (DOM) tracing statistics. These traces use a structured data format where a single performance measurement (even with all-zero values) is split across multiple log lines to preserve JSON-like context. When background storage tasks or management polling occurs, the resulting spike in trace generation saturates the syslog forwarding buffer, leading to the high event counts observed in remote logging tools.

Resolution

To resolve the log flooding, disable the forwarding of vSAN traces to the remote syslog server. Native traces will continue to be stored locally on the ESXi host for troubleshooting purposes.

• Log in to the affected ESXi host(s) via SSH.
• Check the current status of vSAN trace syslog forwarding: esxcli vsan trace set --logtosyslog
• Disable forwarding to syslog: esxcli vsan trace set --logtosyslog false
• (Optional)  Filter out or ignore these messages through Aria operations, as these messages are informational only.