/storage/log filling up with imfile-state files | rsyslogd
search cancel

/storage/log filling up with imfile-state files | rsyslogd

book

Article ID: 318149

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

Symptoms:

/storage/log is filling up and there are many files in the /var/log/vmware/rsyslogd directory. You may or may not be able to list the contents of /var/log/vmware/rsyslogd/.


Environment

VMware vCenter Server 7.0.x

Cause

The imfile-state:XXXX files are created due to the rsyslog daemon's method of tracking messages that have already been sent to the syslog server.

Resolution

To resolve this issue, create a cron job to clear these files.

  1. Stop rsyslog
systemctl stop syslog.socket rsyslog.service
  1. Verify that the service is stopped
ps aux | grep rsyslogd
  1. Verify in /var/run that rsyslogd.pid does not exist
  2. Create a directory for the cron job

cd ~
mkdir syslogcron
cd syslogcron/

  1. Create a file called cleanimf.sh and save it with contents below.
vi cleanimf.sh

#!/bin/bash
find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}
  1. After saving the file (by typing ':wq'), apply permissions to the file
chmod 755 cleanimf.sh
  1. Create a cron job to execute the script every hour (remember to save the file with ':wq')
cd /etc/cron.d

vi cleanimf.cron

0 * * * * root /root/syslogcron/cleanimf.sh 2>&1
  1. Start the rsyslog daemon
systemctl start syslog.socket rsyslog.service


Additional Information

To remove all the files immediately (before creating the cron job), run the following command and wait until it finishes:
 
find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}