We have a number of ESXi 5.0 (Build 1311175) servers configured to submit logs to two syslog servers. Under Configuration->Software->Advanced Settings, in Syslog.global, we have set Syslog.global.loghost to be a comma separated list of two hostnames.
The syslog servers are running rsyslog and create per-host directories with year/month/data subdirs under each and the logs for each day go to a distinct directory. We are receiving logs on the central rsyslog servers with three different values for the second field of the log messages from the ESXi host:
- short hostname
- fully-qualified hostname
- no hostname
As such, we are getting two host related directories created and we get some number of random top-level "host" directories created as well.
Here are samples of each type of log records:
Short Name:
Feb 17 00:01:37 esx21a --> changeVersion = < esx21a.domain.org Vpxa: nset>,
Feb 17 00:01:37 esx21a --> dynamicType esx21a.domain.org Vpxa: = <unset>,
Feb 17 00:01:37 esx21a --> dynamicType esx21a.domain.org Vpxa: = <unset>,
Feb 17 00:01:37 esx21a --> },#012 esx21a.domain.org Vpxa:
Feb 17 00:05:15 esx21a --> dynamicType = <un esx21a.domain.org Vpxa: et>,
Feb 17 00:05:15 esx21a --> entity = 'vim.Res esx21a.domain.org Vpxa: urcePool:resgroup-489',
Feb 17 00:05:15 esx21a --> changeVersion = < esx21a.domain.org Vpxa: nset>,
Feb 17 00:05:15 esx21a --> lastModified = <u esx21a.domain.org Vpxa: set>,
Long Name:
Feb 17 00:00:00 esx21a.domain.org Vpxa: [6E0D6B90 verbose 'VpxaHalCnxHostagent' opID=WFU-88ac91b5] [WaitForUpdatesDone] Received callback
Feb 17 00:00:00 esx21a.domain.org Vpxa: [6E0D6B90 verbose 'VpxaHalCnxHostagent' opID=WFU-88ac91b5] [VpxaHalCnxHostagent::ProcessUpdate] Applying updates from 4391452 to 4391453 (at 4391452)
Feb 17 00:00:00 esx21a.domain.org Vpxa: [6E0D6B90 verbose 'VpxaHalCnxHostagent' opID=WFU-88ac91b5] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd
Feb 17 00:00:00 esx21a.domain.org Vpxa: [6E0D6B90 verbose 'VpxaHalCnxHostagent' opID=WFU-88ac91b5] [WaitForUpdatesDone] Completed callback
Feb 17 00:00:00 esx21a.domain.org Hostd: [6F1FEB90 verbose 'SoapAdapter'] Responded to service state request
Feb 17 00:00:00 esx21a.domain.org Hostd: [715D3B90 verbose 'SoapAdapter'] Responded to service state request
No Host Name: ('Section' is considered the hostname by rsyslog) (you'll see a mix of hostnames embedded in the log messages)
Feb 17 00:01:03 Section for VMware ESX, esx21a.domain.org Vpxa: id=5298, version=5.0.0, build=build-1311175, option=Release
Feb 17 00:03:02 Section for VMware ESX, esx21c.domain.org Vpxa: id=5299, version=5.0.0, build=build-1311175, option=Release
Feb 17 00:11:18 Section for VMware ESX, esx22c.domain.org Vpxa: id=5295, version=5.0.0, build=build-1311175, option=Release
Feb 17 00:24:49 Section for VMware ESX, esx21c.domain.org Vpxa: id=5299, version=5.0.0, build=build-1311175, option=Release
Any ideas on how to force the ESXi server to consistently use one form of the hostname, and to always use the hostname?
