Hi All
Could someone please confirm are ESXi 4 log files retained after a host restart with local disks ?
Ashley
Ashley,
Per the April 2011 Hardening Guide, "by default, the logs on ESXi are stored only in the
in-memory file system. They are lost upon reboot, and only one day’s worth of
logs are stored. Persistent logging to a datastore can be configured. It is
recommended that this be done so that a dedicated record of server activity is
available for that host."
You can either push them out to a Syslog server, or if that's not available, to a datastore. The latter was the option that I did recently and it seems to be working out ok for us so far (though a Syslog server would probably be preferrable).
Jeff
Hi Jeff
Thank you for the answer, wasn’t a 100 % sure, reference from the hardening guide is exactly what I was looking for – Thanks
Ashley
Your best bet is to build a VMA and allocate space for a syslog directory and have the hosts logs written there.