Unpredictable error observed on Syslog server during log forwarding from vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• The following error message is logged on the Syslog server:
  

  MM  DD HH:MM:SS #### syslog.err: rsyslogd error during parsing file /etc/vmware-syslog/vmware-services-vlcm.conf, on or before line 8: parameter 'reopenontruncate' must be "on" or "off" but is neither. Results unpredictable. [v8.2306.0 try https://www.rsyslog.com/e/2207 ]
  MM  DD HH:MM:SS #### syslog.err: rsyslogd error during parsing file /etc/vmware-syslog/vmware-services-vlcm.conf, on or before line 8: parameter 'deletestateonfiledelete' must be "on" or "off" but is neither. Results unpredictable. [v8.2306.0 try https://www.rsyslog.com/e/2207]
  

  
  Note: This is a warning logged during configuration file parsing. The rsyslog service continues to function and forward logs with other configured options, though the reopenOnTruncate parameter setting is ignored until corrected.
  
  
• The deleteStateOnFileDelete and reopenOnTruncate parameters within the /etc/vmware-syslog/vmware-services-vlcm.conf file on the vCenter Server are set to "true".

 

Environment

VMware vCenter 9.x

Cause

This issue occurs when a cron job on the vCenter Server unintentionally sets the deleteStateOnFileDelete and reopenOnTruncate parameters to "true".
The rsyslog service only supports "on" or "off" values.

Resolution

This issue will be resolved in a future product release.


Workaround:

1. Connect to the vCenter Server via SSH and access the Bash shell.
   
   
2. Create a backup of the configuration and script files by running the following commands:
   cp /etc/vmware-syslog/vmware-services-vlcm.conf /etc/vmware-syslog/vmware-services-vlcm.conf_bk
cp /usr/lib/applmgmt/support/space_utility/datastructures.py /usr/lib/applmgmt/support/space_utility/datastructures.py_bk
   
   
3. Modify the /usr/lib/applmgmt/support/space_utility/datastructures.py file as follows:
   
   

   Before:

   def flags_to_check(self):
       """Returns the im module definition's mandatory flags
       and its expected flag values
       """
        return {
             'deleteStateOnFileDelete': {'"on"', '"true"'},
             'reopenOnTruncate': {'"on"', '"true"'},
        }

   
   After :

   def flags_to_check(self):
       """Returns the im module definition's mandatory flags
       and its expected flag values
       """
       return {
           'deleteStateOnFileDelete': {'"on"'},
           'reopenOnTruncate': {'"on"'},
       }

   Note: Pay special attention to proper indentation and ensure all quotes are standard straight quotes (" or ').

4. Verify that the parameters automatically update to "on" and the issue resolves following the next scheduled cron job execution (runs daily at midnight).