Error: vmsyslog logger lost log messages and alarm.HostErrorAlarm alerts

Products

• VCF Operations

Issue/Introduction

ESXi hosts experience syslog message loss and trigger frequent HostErrorAlarm alerts in VCF Operations. Log output displays vmsyslog logger lost log messages. This occurs when syslog forwarding is configured to send logs to both the Cloud Proxy IP address and the VCF Logs VIP simultaneously.

Environment

VCF Operations 9.0.2

Cause

When "Collect logs using the collector/group" is enabled for the vCenter adapter in VCF Operations, the system automatically appends the Cloud Proxy IP address to the Syslog.global.logHost property on the ESXi host. If the environment is also configured to forward logs to a VCF Logs VIP, this creates a duplicate configuration, resulting in syslog message loss and frequent HostErrorAlarm alerts.

Resolution

Configure log collection to target the Logs cluster directly:

1. Log in to the VCF Operations UI.
2. Navigate to Administration > Integrations.
3. Locate the vCenter adapter, click the ellipses (⋮), and select Edit.
4. In the log collection settings, select Collect logs directly into Logs cluster.
5. Click Save to apply the configuration.
6. Restart the syslog service on the affected ESXi hosts using the CLI command: 
   /etc/init.d/vmsyslogd restart

 

Additional Information

For additional details on syslog troubleshooting, refer to Syslog troubleshooting for VCF Operations.