Filtering logs in VMware vSphere ESXi

Products

VMware vSphere ESXi

Issue/Introduction

VMware vSphere ESXi 6.0 introduced the ability to filter or exclude logging expressions from the system logs.

This article provides information on filtering or excluding specific logging expressions from the system logs. This process is useful for removing trivial or informational logging events from the system logs.

Environment

VMware vSphere ESXi 8.x
VMware vSphere ESXi 7.x
VMware vSphere ESXi 6.x

Resolution

Caution: VMware by Broadcom does not recommend reducing logging as it may make it impossible to properly troubleshoot potential future issues.

To enable log filtering and exclude a log expression:

Log in to the VMware vSphere ESXi host as root via console or SSH.
Run this command to save the original vmsyslog.conf file :
```
# cp /etc/vmsyslog.conf /etc/vmsyslog.orig
```
Using a text editor, open the /etc/vmsyslog.conf and add the line:
```
enable_logfilters = true
```
Save the file.
Using a text editor, open the /etc/vmware/logfilters file and add the log expression to exclude using the format:
```
numLogs | ident | logRegexp
```
Values:

numLogs - This value is the number of times the log entry can appear before it is filtered and excluded from system logs.

Note: By setting this value to zero, the expression defined will be suppressed from the system logs. Values greater than zero will result in the suppression of the expression defined when repeated in close proximity within the system logs.

ident - This value is used to identify the originating location of the log expression. For more information, see the /etc/vmsyslog.conf.d/*.conf files for all available values.
logRegexp - This value is used to define the log expression to exclude conforming to the Python regular expression syntax.

Example:
Some rescan commands for local storage devices will report a SCSI log expression in the vmkernel.log that can be safely filtered.

Below is an example of the file logfilters including these expressions:
```
0 | vmkernel | 0x1a.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x2[04] 0x0
0 | vmkernel | 0x85.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0
0 | vmkernel | 0x12.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x24 0x0
0 | vmkernel | 0x9e.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0
0 | vmkernel | bad CDB .* scsi_op=0x9e
0 | vmkernel | 0x4d.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0
```
Save the file
Run this command to reload the syslog service and apply the log filter:
```
# esxcli system syslog reload
```