syslog vs scratch

[Meetoo]

Which setting should be used to configure the location for Host logs? I have a Vcenter 5.5 environment with 5 hosts.  I plan to send them to a datastore folder, not a syslog server.

Is it 'syslog.global.logdir' or 'scratchconfig.configurationscratchlocation' OR some other setting?

I have found conflicting information.

Thanks

[cykVM]

This might help: VMware KB: Configuring syslog on ESXi 5.x and 6.0

[Anjani_Kumar]

'syslog.global.logdir' is been used for the Location and you need to provide the settings like [Datastorename]Foldername (e.g. [datastore01]Syslog).

This will save the data to your Datastore location.

[Meetoo]

What is the purpose of 'scratchconfig.configuredscratchlocation'?

[Anjani_Kumar]

Normally ESXi has a persistent scratch location available for storing temporary data including logs, diagnostic information, and system swap files. which is not necessary to configure. by Default Scratch space is configured automatically during installation or first boot of an ESXi host, and does not usually need to be manually configured.

A similiar thread is also opened for the same have a look : Re: Scratch config vs syslog

[UmeshAhuja]

Hi,

Configuring a persistent scratch location using the vSphere Client

To configure persistent scratch space for ESXi using the vSphere Client:

1. Connect to vCenter Server or the ESXi host using the vSphere Client. 
2. Click the ESXi host in the inventory. 
3. Under the Configuration tab, click Storage. 
4. Right-click a datastore and click Browse. 
5. Create a uniquely-named directory for this ESXi host (for example, .locker-ESXHostname). 
6. Close the Datastore Browser. 
7. Click Advanced Settings under Software. 
8. Select the ScratchConfig section. 
9. Change the ScratchConfig.ConfiguredScratchLocation configuration option, specifying the full path to the directory. For example:
   
   /vmfs/volumes/DatastoreUUID/.locker-ESXHostname

Note: To determine the Datastore UUID: 
   1. Navigate to Configuration > Storage. 
   2. Select the datastore. 
   3. View Location under Datastore Details.
      
      The Datastore UUID appears similar to /vmfs/volumes/51dda02d-fade5016-8a08-005056171889 where 51dda02d-fade5016-8a08-005056171889 is the UUID.
      
      
10. Click OK. 
11. Put the ESXi host into maintenance mode and reboot for the configuration change to take effect

[Meetoo]

Sorry, but I still don't understand the difference between Scratch logs and the Syslogs , especially since we do not have a syslog server.  Am I supposed to configure both settings?  Thx

[Anjani_Kumar]

there is not enough difference between syslog and scratch. In many environments today Syslog is not used but there is real value in ESXi environments. Syslog will allow you to consolidate all logs into a single location.Using a syslog server will simplify troubleshooting and ensure that log files are accessible even when a VMware ESXi host has physically failed.Scratch space is configured automatically during installation or first boot of an ESXi 4.1 U2 and earlier host, and does not usually need to be manually configured.When using Boot-from-SAN or USB ,scratch partitions are not automatically created and the above mentioned files will be stored in a RAM disk

So its totally your choice what you want. If you can afford to buy a syslog server he can go for it .But ESXi Host cannot guarantee that remote syslog server is retaining the logs.We have to monitor it and in worst case it may also fill up

if you really want to configure the syslog a nice tool called sexilog which collects and gather all your data in to the server and give you a graphical representation.

SexiLog : See your syslog data Live… | Vmwareminds

[UmeshAhuja]

Hi,

I. SCRATCH PARTITION

The scratch partition is *not* used for the typical logs which most of us are familiar with. In vSphere the scratch partition is used for storing the vm-support command output (support-bundle); it is also where the logs are stored initially, by default, in those cases when the partition gets automatically created – see below. You would typically provide this information when logging a support call with VMware.

• Configuration: you can use either the command line (ESXCLI/PowerCLI) or the GUI – see the official documentation (search for Scratch)
• Size: 5 GB VFAT Partition *per host*; exceptionally, it is 512 MB only when created in RAM (see below)
• Not mandatory – that’s right; you can configure it, but you don’t have to. You will get a warning but it won’t stop the system from functioning.
• Automatically installed? It depends …
  • ◦PXE installation, there is no local scratch partition configured
  • ◦Installable installation, the scratch partition is automatically created during installation
  • ◦Embedded installation, a scratch partition is automatically created on a local-disk, if one exists; it will otherwise be installed in RAM (ramdisk) using 512 MB of the actual physical RAM installed (not recommendable)
• Reboot Is Required when configuring/changing the location of the scratch partition
• Best Practices
  • Do configure a scratch partition; make sure it’s on persistent storage – either local-disk or shared storage; USB/SD is not considered local disk! Before rebooting, make sure you put the host in maintenance mode
  • 20 GB of storage should be enough space for a large cluster (recommended by VMware)
  • Make sure you use a folder for each host.

II. SYSTEM LOGS

The system logs is what we are used to see – we would normally use a remote server running Syslog and forward all logs to that server, in real-time. Having the logs stored on a Syslog server allow for quicker access since most implementations provide advanced search capabilities. By default, this connection would occur over TCP or UDP, on port 514.

Though by default, these logs are *also* stored locally in the folder /var/logs/ (linked to the Scratch partition, when one exists). This location could also be changed so that logs are all stored on a remote storage location – this could be an NFS share or another shared storage available to the host.

• Configuration: To start off, should you choose to forward the logs to a syslog server, make sure you allow Syslog on the ESXi host firewall. Also make sure no firewalls are blocking the traffic on the communication path between the ESXi host and the Syslog server. Once this has been done, you will need to edit the following advanced properties: Syslog.global.logdir, Syslog.global.logDirUnique & Syslog.global.logHost.
• As a Syslog server, you could use either vSphere Syslog Collector, available on the vCenter installation CD (automatically deployed along with VCSA) or, you could use any other Syslog server implementation available.
• Size: variable
• Automatically Installed  when deployed with vCenter Server Appliance (VCSA). It will also be automatically installed when installing vCenter for Windows depending on which installation type you’ve chosen.
• Reboot Required: No
• Best Practices:
  • Make sure you do forward your system logs to a Syslog server; really, do not miss that!
  • Make sure whichever process/system you are using, you have enough space to store the logs
  • Ensure you are using an NTP server on your network – it is very frustrating to look at log messages and not to know when they actually occurred
  • Make sure you logs get stored/organized by the source