/storage/log filling up with imfile-state files | rsyslogd

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

/storage/log is filling up and there are many files in the /var/log/vmware/rsyslogd directory.  The contents of /var/log/vmware/rsyslogd/ may or may not be listed.

Environment

VMware vCenter Server 7.0.x

Cause

The imfile-state:XXXX files are created due to the rsyslog daemon's method of tracking messages that have already been sent to the syslog server.

Resolution

To resolve this issue, create a cron job to clear these files.

1. Stop rsyslog

systemctl stop syslog.socket rsyslog.service

2. Verify that the service is stopped

ps aux | grep rsyslogd

3. Verify in /var/run that rsyslogd.pid does not exist
4. Create a directory for the cron job

cd ~
mkdir syslogcron
cd syslogcron/

5. Create a file called cleanimf.sh and save it with contents below.

vi cleanimf.sh

#!/bin/bash
find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}

6. After saving the file (by typing ':wq'), apply permissions to the file

chmod 755 cleanimf.sh

7. Create a cron job to execute the script every hour (remember to save the file with ':wq')

cd /etc/cron.d

vi cleanimf.cron

0 * * * * root /root/syslogcron/cleanimf.sh 2>&1

8. Start the rsyslog daemon

systemctl start syslog.socket rsyslog.service

Additional Information

To remove all the files immediately (before creating the cron job), run the following command and wait until it finishes:

find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}

/storage/log が imfile-state ファイルでいっぱいになる | rsyslogd

-----------------------------------------------------------------

 

The time interval that the cron job removes these files may need to be increased to remove the files at the rate they are created

We can alter the cron job to run it every 30 minutes instead of every hour by altering step 7 with the command bellow:

 

Change 

"0 * * * * root /root/syslogcron/cleanimf.sh 2>&1" 

To

"*/30 * * * * root /root/syslogcron/cleanimf.sh 2>&1"