/var/log/messages not logging

[FadiAmatoury]

Hi,

I am having problems with one host not logging anything past 24/03/2011 for /var/log/messages. There are still logs for var/log/vmware/vpx/vpxa.log and /var/log/vmware/hostd.log which are up-to-date.

This started happening after host was removed from cluster and replaced with newer/higher spec'd server to replace. The hostname and IP address was changed to be that of original host.

Build: ESXi 4.1 348481

- Checked logs through vSphere client and could not find any logs past 24/03/2011 (when hostname was changed)

- Host was originally introduced as a new server and not re-conected from old host

- Checked \var\log\messages folder and not logs past 24\03\2011

- Restarted management agent through DCUI

- Server was rebooted after hostname change originally but has not been rebooted since.

- Tried a services.sh restart

Do you have any ideas and preferably not rebooting server again?

Also, all other logs show time which is about 2 hours fast. All hosts connect to an NTP server and show time correctly.

Thanks,
Fadi

[grasshopper]

Perhaps someone was playing with the syslog options while this was still a test box.  See the following KB for the locations to check:

http://kb.vmware.com/kb/1016621

Additional locations to check would be /etc/rc.local if someone was doing custom changes then running auto-backup.sh to persist across reboots.  If you are the only admin then you can disregard all of the above as these don't change on their own.

[FadiAmatoury]

mmmm....at the moment i am the only one that makes the changes in the VM space.

I have checked the knowledge base article you referred to and after following steps to configure remote syslog server with both FQDN and IP address I still cannot seem to get it working. If i navigate to the datastore path for local syslog logging i can only see logs for the 24\03\2011. Management agents have also been restarted again from the DCUI.

Do you have any other ideas? It looks like i may need to reboot.

[Dave_Mishchenko]

If check the free space (vdf -h and df -h) .   A restart may help, but if it doesn't you can reset the system configuration within the DCUI.  After that you get a "fresh" config of ESXi and you'll need to re-register your VMs.

[LarryBlanco2 · Accepted solution]

If you have multiple host, you may want to consider using a syslog server to host all your logs.  This way, if you restart the server your logs are not flushed.

If you currently do not have a syslog server, the vMA will do it for you.  The 'vilogger' command is what you will use.  I currently use the vMA to log all the data from all my hosts.  it's great for 10 hosts or so.  Above that I would opt for something a bit more robust.

Here is an excellent write-up/article on setting up vMA to be your syslog server.

http://www.simonlong.co.uk/blog/2010/05/28/using-vma-as-your-esxi-syslog-server/