Tom_NL
Contributor
Contributor

vCenter Appliance syslog rotation

Hi,

In the normal Windows based vCenter, there are options to set log rotation settings for the syslog service to which the ESXi-hosts are logging.

I can't find this option in the vCenter Appliance. Does it do this automatically? Or do I need to do manual scripting for this?

Visit my blog: http://virtualmatter.wordpress.com/
7 Replies
a_p_
Leadership
Leadership

Please take a look at virtuallyGhetto: Forwarding vCenter Server Logs to a Syslog Server to see whether this answers your question. Basically there's no need to take care about log rotation in the appliance due to symlinks pointing to the current log files.

André

0 Kudos
Tom_NL
Contributor
Contributor

That article is about sending log files from the vCenter Appliance to a remote syslog server. That's not what i'm looking for.

I'm redirecting the ESXi logfiles to the build in syslog functionality in the vCenter Appliance. See this article: http://kb.vmware.com/kb/2003322

Visit my blog: http://virtualmatter.wordpress.com/
0 Kudos
oturn
Enthusiast
Enthusiast

Any news on this? We're in the process directing all host syslog files to our vCenter Server Appliance. Within a week or two, logging on the appliance filled up. Surely there are retention policies that can be set on the appliance? The policies directly on the ESXi hosts don't apply to the syslog server. We would rather not have to deal with expanding or adding storage on the appliance.

0 Kudos
AKInfra
Contributor
Contributor

This is how I have configured the vCenter Appliance to rotate the syslogs from my ESXi hosts.  I'm not sure if these changes are supported by VMware, or if they survive an upgrade, so buyer beware.

  1. Backup the syslog-collector.conf configuration file.

    cp /etc/syslog-ng/syslog-collector.conf /etc/syslog-ng/syslog-collector.conf.orig

  2. Edit syslog-collector.conf and change the file format:

    file("/var/log/remote/$HOST_FROM/messages"

  3. Reload syslog-collector service.

    /etc/init.d/syslog-collector reload

If you use the same file format as I have then you should now have a messages file for each host under /var/log/remote/hostname.  I use the following config file to rotate the logs daily:

/etc/logrotate.d/syslog-remote

/var/log/remote/*/messages {

  daily

  compress

  delaycompress

  rotate 14

  postrotate

    /etc/init.d/syslog-collector reload > /dev/null

  endscript

}

oturn
Enthusiast
Enthusiast

Thank you for this!

Can you explain further how the syslog-remote file works? We have bz2 files that have a weeks worth of logs so far.

0 Kudos
AKInfra
Contributor
Contributor

rotate 14

will keep the compressed files for 14 days.  Reduce the number to however many days worth of logs you want to keep.

See the logrotate documentation for an explanation of all the values:

http://linux.die.net/man/8/logrotate

0 Kudos
conresjkozej
Contributor
Contributor

Check this link out for help. I think it contains the answer for what you are looking for.

http://vdoogle.wordpress.com/2014/07/14/vcenter-server-appliance-5-5-syslog-collector-rotation/