p3tter
Contributor
Contributor

Change ESXI 6.5 Syslog level from debug to info

Hi,

I have configured syslog logging for my ESXI 6.5 hosts.

I have configured loglevel info for all syslog/vxa related entries in advanced settings.

My syslog server is filled up with crap (approx 100k messages a day from 1 host!)

I know I can edit the RHTTPPROXY config file and change it from verbose to info, but I cant find anything related to the HOSTD (and it should not be necessary to change the xml config files for something like this)...

Has anyone seen this before?

Thanks,

2018-06-21 20:28:10Informational (6)HOSTD info hostd[EB81B70] [Originator@6876 sub=SysCommandPosix opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] ForkExec(/sbin/localcli) 23017300
2018-06-21 20:28:10Informational (6)HOSTD info hostd[EB81B70] [Originator@6876 sub=Hostsvc.SyslogConfigProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] Set called with key 'Syslog.global.logHost', value '""'
2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[EB81B70] [Originator@6876 sub=PropertyProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] RecordOp ASSIGN: info, haTask-ha-host-vim.option.OptionManager.updateValues-201918470. Applied change to temp map.
2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[10C85B70] [Originator@6876 sub=PropertyProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] RecordOp ADD: recentTask["haTask-ha-host-vim.option.OptionManager.updateValues-201918470"], ha-taskmgr. Applied change to temp map.
2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[10C85B70] [Originator@6876 sub=PropertyProvider opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] RecordOp ADD: recentTask["haTask-ha-host-vim.option.OptionManager.updateValues-201918470"], ha-host. Sent notification immediately.
2018-06-21 20:28:10Informational (6)HOSTD info hostd[10C85B70] [Originator@6876 sub=Vimsvc.TaskManager opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a-1ff6 user=vpxuser:vpxuser] Task Created : haTask-ha-host-vim.option.OptionManager.updateValues-201918470
2018-06-21 20:28:10Informational (6)VPXA info vpxa[12154B70] [Originator@6876 sub=vpxLro opID=AdvancedSystemSettingsEditResolver-apply-3798598-ngc:70208014-83-9a] [VpxLRO] -- BEGIN lro-342507 -- EsxHostAdvSettings -- vim.option.OptionManager.updateValues -- 52fcbb75-4be2-f795-2d0f-deb30f1ecbf4
2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8CC2B70] [Originator@6876 sub=Proxy Req 39098] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502dd8] _serverNamespace = /vpxa action = Allow _port = 8089
2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8C81B70] [Originator@6876 sub=Proxy Req 39082] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502dd8] _serverNamespace = /vpxa action = Allow _port = 8089
2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8912B70] [Originator@6876 sub=Proxy Req 00008] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502cc0] _serverNamespace = /sdk action = Redirect _port = 8307
2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[EB81B70] [Originator@6876 sub=PropertyProvider opID=b1971ff2 user=root] RecordOp ASSIGN: info, haTask--vim.AuthorizationManager.retrieveAllPermissions-201918469. Applied change to temp map.
2018-06-21 20:28:10Debugging (7)HOSTD verbose hostd[EB81B70] [Originator@6876 sub=PropertyProvider opID=b1971ff2 user=root] RecordOp ASSIGN: info, haTask--vim.AuthorizationManager.retrieveAllPermissions-201918469. Applied change to temp map.
2018-06-21 20:28:10Debugging (7)RHTTPPROXY verbose rhttpproxy[8890B70] [Originator@6876 sub=Proxy Req 00008] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x08502cc0] _serverNamespace = /sdk action = Redirect _port = 8307
8 Replies
Finikiez
Champion
Champion

Hello!

Ususally hostd generates a lot of messages and this is ok. Also by defaul it shoud be on informational level.

Check Modifying the Log Level to Obtain Detailed Information

0 Kudos
kwg66
Hot Shot
Hot Shot

The logging on all of my v6.5 hosts is the default, and in the advanced settings config.HostAgent.log.level shows the level is info. 

However, in our syslog application the folks who support it are showing me "verbose" entries, and they are complaining about the amount of them and their usefulness in the system. 

Why the F if this is set to info are we seeing 1000s of "verbose" logs?  

I see that nobody answered this so I'm probably a dumb ass for posting here, but none the less, maybe VMware engineers will see this and chime in to answer this post with real details and not KB regurgitation.   The KBs I have looked at regarding VMware logging are about the worst KBs I've ever laid eyes on and are not that helpful with sorting out what's what in regard to logging. 

If there is a good link that fully explains VMware logging please post it here.. 

0 Kudos
quinh
Contributor
Contributor

I feel the same. It would be cool to keep verbose (info) logs on the system itself, but only send a smaller amount (like warnings) to the syslog server.

0 Kudos
kwg66
Hot Shot
Hot Shot

I would simply like to see the instructions for modifying the individual log level for those specific logs that are set to verbose so that if I desire I can lower these specific levels, however, I have been unable to find anything about it, I do see references mentioned about it, but no instructions to be found. 

So, I opened a ticket with VMware support to have someone provide this detail, over a week later I have received a response from support other than "we are still working on it."  

This tells you a little something if you read between the lines:   VMware outsourced support is far removed from the knowledge of product engineers, and they simply rely on the same information available to the general public to resolve cases, and when the documentation isn't published, they have almost no where to turn. 

0 Kudos
thomashoefler
Contributor
Contributor

Hi,

did you already receive an answer from support ? As I am in the same situation, it would be great if you could share it with us.

0 Kudos
kwg66
Hot Shot
Hot Shot

Support was not helpful at all, I ended up finding this KB which needs some work it is not written well at all, needs to be revisited in my opinion..  the structure of the advanced settings has changed starting in vSphere 6 so you no longer see the inventory tree with the "loggers" option where the advanced settings can be managed for syslog levels, so you will most likely need to go to the ESXi shell to make the necessary changes. 

VMware Knowledge Base

Our security team is looking for a new logging solution now and is concerned about the licensing, they asked me to find another solution for the vSPhere logs so they aren't bombarding the new solution, so I have decided to use the "logdir" parameter and send the logs to a mounted NFS share.   The allows you to control the logs with advanced settings, log file sizes and rotations, and if the fabric is down you can still reach the logs (provided you configure the share properly to allow access to other hosts than ESXi.

0 Kudos
domingougarte
Contributor
Contributor

I had the same problem, until I set config.HostAgent.log.level to 'warning' and then back to 'info'. I had this happen to me on a single host so it wasn't a widespread issue for me.

ohthatguy
Contributor
Contributor

Thanks Domingo, this worked for me as well!

0 Kudos