I have a pair of linked vCenters (VCSA 6.5 U1f, build 7801515) and both ran into the same problem where '/dev/sda3' grew to 100%, leading to all kinds of UI/functionality issues. It seemed the culprit was '/var/log/messages', which was about 5.5 GB - half the total disk size. After I wiped the contents of the file, '/dev/sda3' dropped to ~50% and everything was fine.
Looking at '/var/log', the date of all the archived 'messages' files except one is 2018, except for the first one, which is 2135. ('tallylog' is in a similar situation, but the main file is small so it's not a big deal.) Does this imply that log rotation isn't working for these files?
I checked out '/etc/logrotate.d/syslog' file, which I've never modified and which as far as I can tell looks normal. But I don't know what to do beyond that to confirm if log rotation is doing what it's supposed to do. Can anyone help?
(See attached for output of 'ls -lh /var/log' and 'cat /etc/logrotate.d/syslog'.)
PS Yes, I know I need to upgrade! But I won't be able to do that without a lot of planning (high profile customer; complex environment), so I need to fix this first.
