vMA and Syslog - Size Estimates

[logiboy123]

I'm currently working for a client with two major Datacenters; Northern and Southern. I need to send the ESXi host logs to a vMA in each Datacenter and I need to find out how much space to provision to the log drive on each vMA.

There are currently 14 hosts in the Northern datacenter and 16 in the Southern but this number could grow by a maximum of 8 per region. So the totals could get as high as 22 Nothern, 24 Southern.

I plan I doing the default logging type.

There is probably a sizing calculator around somewhere but I have not yet been able to find one. Any help would be appreciated.

Cheers,

Paul

[DSTAVERT]

It works far better going East and West but you can still do North and South.

Will you be using the standard syslog server in vMA? You would do better with rsyslog or syslog-ng. With either of those you can choose what data to retain using filters. Both of them can write data to a database as well as to files. Do you have retention needs? It is easy to simply add vmdks that mount to the log directory and rotate them out when they get full.

[logiboy123]

I'm in New Zealand. Not the USA. 😉

[Dave_Mishchenko · Accepted solution]

From an ESXi host you can capture messages, hostd.log and vpxa.log.  

When you configure log capturing you can configure maxfilesize (default of 5 MB) and numrotation (default of 5 files).  So you would be looking at 75 MB per host.   For vCenter you capture vpxd.log so that will be 25 MB.

As mentioned it's a pretty easy thing to expand the storage space used by the vMA.

[logiboy123]

Dave,

I have found the middleware team in this environment has a splunk installation so I'm going to leverage their systems. However your input is useful for future implementations. So thank you very much.

Regards,

Paul