Free ESXi + Persistent logging

[Hassle2]

Hello,

I am aware of being able to use a remote syslog server as well as placing the log files in a different folder.

My question is this: If the log files were redirected into a folder that resided within a VMFS volume, is there any type of log rotation or process to prevent a log file from growing unchecked?

[lamw · Accepted solution]

It'll rotate based on a configured default.

To get the default setting, you'll need to login to the unsupported Busybox console.

You'll need to use the muti-binary utility "busybox" to get access to the syslogd:

/vmfs/volumes/4c0cb98f-9691c526-47ea-005056934adc/syslog # busybox syslogd -h
syslogd: invalid option -- h
BusyBox v1.9.1-VMware-visor-654 (2008-12-17 10:01:32 PST) multi-call binary

Usage: syslogd [OPTION]...

System logging utility.
Note that this version of syslogd ignores /etc/syslog.conf.

Options:
        -n              Run in foreground
        -O FILE         Log to given file (default=/var/log/messages)
        -l n            Set local log level
        -S              Smaller logging output
        -s SIZE         Max size (KB) before rotate (default=200KB, 0=off)
        -b NUM          Number of rotated logs to keep (default=1, max=99, 0=purge)
        -R HOST[:PORT]  Log to IP or hostname on PORT (default PORT=514/UDP)
        -L              Log locally and via network (default is network only if -R)

As you can see the default is to rotate when its > 200KB and max number of rotations is 1. You can change these defaults if you need to, again this is probably not recommended by VMware and the changes may or may not persist through a reboot depending if the configuration file is backed up hourly via the internal ESXi processes. Also note, that it says this version of syslogd does not use /etc/syslog.conf, so you don't need to bother adding the changes in that file.

You can change the default using something like:

busybox syslogd -n -s 10 -b 10

You may also want to try just changing the defaults, reboot the host and see if it takes or if it takes w/o any changes. To do the latter, just remove the "-n" flag.

UPDATE: The changes actually take effect right away, you don't need the "-n" flag. Though the question is if it'll hold through a reboot.

=========================================================================

William Lam

VMware vExpert 2009

VMware scripts and resources at:

Twitter: @lamw

Getting Started with the vMA (tips/tricks)

Getting Started with the vSphere SDK for Perl

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Community

If you find this information useful, please award points for "correct" or "helpful".

[Hassle2]

Excellent!

This will help when network connectivity breaks and provide something that lasts through a reboot.

[lamw]

Here is a more detail write up and some of the limitations: http://www.virtuallyghetto.com/2010/06/increase-syslog-count-in-esxi-using.html

=========================================================================

William Lam

VMware vExpert 2009,2010

VMware scripts and resources at:

Twitter: @lamw

Getting Started with the vMA (tips/tricks)

Getting Started with the vSphere SDK for Perl

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Community

If you find this information useful, please award points for "correct" or "helpful".

[Hassle2]

Thanks for the more detailed write up. I am glad that it was an 'interesting question.' And for referrence, I could find that VMware mentions (Link)being able to change the syslog log file path to a datastore but never touches upon log rotation or log size.

[DSTAVERT]

You can consider forwarding to a log server in which case you can totally cover log rotations, and capture logs through a failure/reboot. You also can also provide notifications for failure events. rsyslog or syslog-ng

[Hassle2]

That was our initial configuration. I had logging sent to rsyslog. The issue that we were/are trying to track down also introduces network connectivity problems. I looked at vMA but it looks like the shortest polling period is 10 seconds.