ESXi datastore used to store logs from /var/run/log is filling up

Products

• VMware NSX

Issue/Introduction

• On the ESXi host, searching for large files shows the largest file(s) as being /var/run/log/nsx-syslog*

Note: Details on finding large files on an ESXi host, review KB Investigating disk space on an ESXi host

• None of these file are over 33MB in size.

• There are no more than 28 nsx-syslog.* files.

• The ESXi host's logger configuration file: /etc/vmsyslog.conf.d/nsx-syslog.conf shows:

[vmsyslog-logger]
descr=nsx logs
fclass=FileLoggerSyslog
file=nsx-syslog
id=nsx-syslog
idents=nsx-exporter,nsx-sfhc,nsx-proxy,nsx-opsagent,nestdb-server,netopa,nsx-sha,nsx-sha-python,mpa,cfgAgent,vdpi,sample-exporter,nsx-platform-client,nsx-logger,nsx-idps,nsx-snproxy,nsx-snhostproxy
nclass=NetworkFilterSyslogTimestamp
rotate=28
size=32768

Environment

• VMware ESXi

• VMware NSX

Cause

As per the syslog configuration, the nsx-syslog files are expected to be approx. 33MB in size and up to 28 of these files. 

Resolution

If there are no issues with the nsx-syslog files and the datastore is reaching capacity, the datastore should be expanded to accommodate the expected size.