6 Replies Latest reply on Dec 3, 2019 5:11 AM by kwg66

    Change ESXI 6.5 Syslog level from debug to info

    p3tter Lurker

      Hi,

      I have configured syslog logging for my ESXI 6.5 hosts.

      I have configured loglevel info for all syslog/vxa related entries in advanced settings.

       

      My syslog server is filled up with crap (approx 100k messages a day from 1 host!)

      I know I can edit the RHTTPPROXY config file and change it from verbose to info, but I cant find anything related to the HOSTD (and it should not be necessary to change the xml config files for something like this)...

       

      Has anyone seen this before?

       

      Thanks,

       

       

      2018-06-21 20:28:10Informational (6)HOSTD info hostd[EB81B70] [Originator@6876 sub=SysCommandPosix opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] ForkExec(/sbin/localcli) 23017300
      2018-06-21 20:28:10Informational (6)HOSTD info hostd[EB81B70] [Originator@6876 sub=Hostsvc.SyslogConfigProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] Set called with key 'Syslog.global.logHost', value '""'
      2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[EB81B70] [Originator@6876 sub=PropertyProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] RecordOp ASSIGN: info, haTask-ha-host-vim.option.OptionManager.updateValues-201918470. Applied change to temp map.
      2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[10C85B70] [Originator@6876 sub=PropertyProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] RecordOp ADD: recentTask["haTask-ha-host-vim.option.OptionManager.updateValues-201918470"], ha-taskmgr. Applied change to temp map.
      2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[10C85B70] [Originator@6876 sub=PropertyProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] RecordOp ADD: recentTask["haTask-ha-host-vim.option.OptionManager.updateValues-201918470"], ha-host. Sent notification immediately.
      2018-06-21 20:28:10Informational (6)HOSTD info hostd[10C85B70] [Originator@6876 sub=Vimsvc.TaskManager opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] Task Created : haTask-ha-host-vim.option.OptionManager.updateValues-201918470
      2018-06-21 20:28:10Informational (6)VPXA info vpxa[12154B70] [Originator@6876 sub=vpxLro opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a] [VpxLRO] -- BEGIN lro-342507 -- EsxHostAdvSettings -- vim.option.OptionManager.updateValues -- 52fcbb75-4be2-f795-2d0f-deb30f1ecbf4
      2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8CC2B70] [Originator@6876 sub=Proxy Req 39098] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502dd8] _serverNamespace = /vpxa action = Allow _port = 8089
      2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8C81B70] [Originator@6876 sub=Proxy Req 39082] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502dd8] _serverNamespace = /vpxa action = Allow _port = 8089
      2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8912B70] [Originator@6876 sub=Proxy Req 00008] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502cc0] _serverNamespace = /sdk action = Redirect _port = 8307
      2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[EB81B70] [Originator@6876 sub=PropertyProvider opID=b1971ff2 user=root] RecordOp ASSIGN: info, haTask--vim.AuthorizationManager.retrieveAllPermissions-201918469. Applied change to temp map.
      2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[EB81B70] [Originator@6876 sub=PropertyProvider opID=b1971ff2 user=root] RecordOp ASSIGN: info, haTask--vim.AuthorizationManager.retrieveAllPermissions-201918469. Applied change to temp map.
      2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8890B70] [Originator@6876 sub=Proxy Req 00008] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502cc0] _serverNamespace = /sdk action = Redirect _port = 8307
        • 1. Re: Change ESXI 6.5 Syslog level from debug to info
          Finikiez Master
          vExpert

          Hello!

           

          Ususally hostd generates a lot of messages and this is ok. Also by defaul it shoud be on informational level.

           

          Check Modifying the Log Level to Obtain Detailed Information

          • 2. Re: Change ESXI 6.5 Syslog level from debug to info
            kwg66 Enthusiast

            The logging on all of my v6.5 hosts is the default, and in the advanced settings config.HostAgent.log.level shows the level is info. 

             

            However, in our syslog application the folks who support it are showing me "verbose" entries, and they are complaining about the amount of them and their usefulness in the system. 

             

            Why the F if this is set to info are we seeing 1000s of "verbose" logs?  

             

            I see that nobody answered this so I'm probably a dumb ass for posting here, but none the less, maybe VMware engineers will see this and chime in to answer this post with real details and not KB regurgitation.   The KBs I have looked at regarding VMware logging are about the worst KBs I've ever laid eyes on and are not that helpful with sorting out what's what in regard to logging. 

             

            If there is a good link that fully explains VMware logging please post it here.. 

            • 3. Re: Change ESXI 6.5 Syslog level from debug to info
              quinh Lurker

              I feel the same. It would be cool to keep verbose (info) logs on the system itself, but only send a smaller amount (like warnings) to the syslog server.

              • 4. Re: Change ESXI 6.5 Syslog level from debug to info
                kwg66 Enthusiast

                I would simply like to see the instructions for modifying the individual log level for those specific logs that are set to verbose so that if I desire I can lower these specific levels, however, I have been unable to find anything about it, I do see references mentioned about it, but no instructions to be found. 

                 

                So, I opened a ticket with VMware support to have someone provide this detail, over a week later I have received a response from support other than "we are still working on it."  

                 

                This tells you a little something if you read between the lines:   VMware outsourced support is far removed from the knowledge of product engineers, and they simply rely on the same information available to the general public to resolve cases, and when the documentation isn't published, they have almost no where to turn. 

                • 5. Re: Change ESXI 6.5 Syslog level from debug to info
                  thomashoefler Lurker

                  Hi,

                   

                  did you already receive an answer from support ? As I am in the same situation, it would be great if you could share it with us.

                  • 6. Re: Change ESXI 6.5 Syslog level from debug to info
                    kwg66 Enthusiast

                    Support was not helpful at all, I ended up finding this KB which needs some work it is not written well at all, needs to be revisited in my opinion..  the structure of the advanced settings has changed starting in vSphere 6 so you no longer see the inventory tree with the "loggers" option where the advanced settings can be managed for syslog levels, so you will most likely need to go to the ESXi shell to make the necessary changes. 

                     

                    VMware Knowledge Base

                     

                    Our security team is looking for a new logging solution now and is concerned about the licensing, they asked me to find another solution for the vSPhere logs so they aren't bombarding the new solution, so I have decided to use the "logdir" parameter and send the logs to a mounted NFS share.   The allows you to control the logs with advanced settings, log file sizes and rotations, and if the fabric is down you can still reach the logs (provided you configure the share properly to allow access to other hosts than ESXi.