vCenter 7.0.0d high CPU load, disk full -> rsyslog

[bl4ckr4ptor]

Hello,

I am running a testlab at home with 2 supermicro servers and a vCenter on it.

After i upgraded from vCenter 7.0.0c to vCenter 7.0.0d I noticed high CPU load and full /storage/core partition on vCenter server. First I increased the partition step by step to 50 GB, but the partition get filled up in just a few minutes. I had no issues with version 7.0.0c. I found out the service rsyslogd is using the CPU that much. I have configured syslog in vCenter Appliance UI since I have installed vCenter 7.0.0, no issues until now. After I disabled syslog, the issue is not showing up anymore. So I think I should start looking there.

Can anyone guide me a little bit, or has already a solution for that issue?

Image added

[Lalegre]

Hello bl4ckr4ptor​,

The issue you are facing is the one you describe but there is nothing reported about that bug in that version. In facts that issue was happening in 7.0.0c. Your multiple "im" files are being created because of the rsyslog service not working propertly. Do you see any log in the service to check why is generating so much dumps?

Regards!

[bl4ckr4ptor]

Hi Lalegre,

Many thanks for your input. I checked the following log file "/var/log/vmware/rsyslogd/rsyslogd-syslog.log", but the entries are all from 16 of may 2020.

I ran journalctl -u rsyslog, there are some hints:

It seems to be an issue with the rsyslog config file, there is a newer version, and the date is from when I did the update to vCenter version 7.0.0d:

Should I post the content from the config file? It is 104 lines long, but the last 2 of them are empty.

[Lalegre · Accepted solution]

Hey,

Some guys were replacing the .conf log for the old one. You can try that and the initiate the service again. The logs are being generated because of the service not being able to properly work.

Also if the files are similar maybe you can compare both of them and make it match. For sure i do not know if this is supported but you can give it a try.

[bl4ckr4ptor]

I replaced the new config with the old one, the cpu load is still high (as expected), but at least, these im.core.xxxx files are not getting created anymore.

I am fine with that, thanks for your support!