HCX migration fails due to var/log full and audit logs fails to rotate

Products

• VMware HCX

Issue/Introduction

• HCX migration (Bullk/vMotin/Cold/RAV) fails with following error

A general system error occurred: Failed to write header to "/var/log/vmware/journal/1786358045.5": Error while writing to file
There is no space left on the device.

• Output of "df -h" in IX appliance shows /var/log consumption at 100%

Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        4.0M     0  4.0M   0% /dev
tmpfs           2.9G     0  2.9G   0% /dev/shm
tmpfs           1.2G  9.0M  1.2G   1% /run
tmpfs           4.0M     0  4.0M   0% /sys/fs/cgroup
/dev/sda4       2.9G  2.0G  804M  72% /
/dev/sda5       488M  1.5M  461M   1% /var/lib
/dev/sda3        89M   57M   27M  69% /boot
/dev/sda6       2.8G   2.8G    0  100% /var/log
/dev/sda2        10M  2.1M  7.9M  22% /boot/efi
tmpfs           592M     0  592M   0% /run/user/0

• Audit log has bloated to it's max and no zip files present

du -csx * | sort -nr | head

996K    audit.log.2026-08-12_15:01:01.gz
32K     audit.log.2026-08-12_22:01:01
2.8G    total
2.8G    audit.log.2026-08-12_16:01:01
0       audit.log.2026-08-16_18:01:01
0       audit.log.2026-08-16_17:01:01
0       audit.log.2026-08-16_16:01:01
0       audit.log.2026-08-16_15:01:01
0       audit.log.2026-08-16_14:01:01
0       audit.log.2026-08-16_13:01:01

Environment

VMware HCX

Cause

Some event flooded the system, causing the active audit log to bloat to its maximum capacity in a very short time period

Log rotation requires free disk space to create the .gz file. Because the file had completely filled the drive, gzip aborted. 

Resolution

Delete the older log files if not needed

Move the logs to /tmp directory or a remote location to free up space in /var/log

Additional Information

HCX cold migration failing with error "Error is A general system error occurred: Failed to send VCC_COMPLETE to destination. Total progress % is 'null'."