1 person found this helpful
Per the April 2011 Hardening Guide, "by default, the logs on ESXi are stored only in the
in-memory file system. They are lost upon reboot, and only one day’s worth of
logs are stored. Persistent logging to a datastore can be configured. It is
recommended that this be done so that a dedicated record of server activity is
available for that host."
You can either push them out to a Syslog server, or if that's not available, to a datastore. The latter was the option that I did recently and it seems to be working out ok for us so far (though a Syslog server would probably be preferrable).
Thank you for the answer, wasn’t a 100 % sure, reference from the hardening guide is exactly what I was looking for – Thanks
Your best bet is to build a VMA and allocate space for a syslog directory and have the hosts logs written there.