Logfile size increased dramatically after upgrade vom vCenter 6.7 to 7.0

[FerdinandG]

Hi,

 

after upgrading my vCenter from 6.7 to 7.0 I noticed that the amount of log data vCenter sends to our remote syslog server has increased dramatically. When before the upgrade the log size was about 100-200MB for a week, we are now talking about 40GB per week:

 

-rw-r-----  1 root  net     6638624 Jul 23 00:00 vcenter.log.7.xz
-rw-r-----  1 root  net     6364652 Jul 30 00:00 vcenter.log.6.xz
-rw-r-----  1 root  net     6596136 Aug  6 00:00 vcenter.log.5.xz
-rw-r-----  1 root  net     6377796 Aug 13 00:00 vcenter.log.4.xz
-rw-r-----  1 root  net     6267080 Aug 20 00:00 vcenter.log.3.xz
-rw-r-----  1 root  net     6313008 Aug 27 00:00 vcenter.log.2.xz
-rw-r-----  1 root  net   589839092 Sep  3 00:00 vcenter.log.1.xz
-rw-r-----  1 root  net  1688840916 Sep 10 00:00 vcenter.log.0.xz
-rw-r-----  1 root  net  8684444543 Sep 11 11:38 vcenter.log

 

Any thoughts on that? Is this normal? And can the amount of logs produced be reduced somehow? 

 

Thank you

Ferdinand

[jc296]

Its a well known problem. Some useful stuff here on this thread:

vCenter logs keep filling up storage and I'm not sure how to prevent that : r/vmware (reddit.com)

There's a few KBs that talk about deleting logs in a safe manner. I take it you have tweaked your logging levels in the vCenter GUI??

 

[FerdinandG]

Thanks... I have decreased the log level on most of my ESXi's to informational ... will check that again. I'm sending the logs to a remote syslog server so space is not such a big concern. According to the vCenter management UI at port 5480, all disks are healthy. But I was just worried that tons of logs might indicate some problem. I guess I'll just introduce faster log rotation ...

[Kinnison]

Hello,

Maybe it's a writing typo, informational level means that almost everything is written in the LOGs, then in the most recent versions of the vCenter object the problem has been significantly mitigated (or solved). Then there are also factors ((sometimes also "external") that can determine a more or less large size of the LOGs but without knowing the size of your environment or their "contents" it is difficult to go beyond somewhat generic advice.

Regards,
Ferdinando

[FerdinandG]

Hm I thought 'info' is considered normal logging, at least according to this KB article: https://kb.vmware.com/s/article/1004795

 

As for my environment, the vCenter appliance is running 7.0.3.01600 while most of the hosts are still at 6.7 (which should change in the near future). The vCenter manages about a dozen clusters with about 40 hosts and roughly 600VMs.

 

I'd like to have a log level at which at least operations performed by users are logged since I was bitten by some cases of 'oops why is this VLAN not working all of a sudden anymore!?" and the likes. Which turned out to be cases of "problem between keyboard and chair" of some low level admins.

[Kinnison]

Hello,

I understand your problem, I ran into it too but some time has passed since then, however I set the LOG level, depending on the case, to "Warning" or "Error". Then, I'll tell you, temperamentally (perhaps due to my age) those who say "oops..." will make me have them a lot of bad times, in my house I can make mistakes whenever I want, but not in other people's houses. 

Regards,
Ferdinando

[FerdinandG]

I've set it to 'error' for now as well. According to the logs written to the syslog server this should still cover/log user initiated tasks like login/logout and configuration stuff performed by those users. I'll monitor how this works out for me. Thanks you anway. 

[Kinnison]

Hello,

Wait a minute, by chance you also use the product mentioned in this thread:
https://communities.vmware.com/t5/VMware-vCenter-Discussions/Log-file-size-is-too-huge/m-p/2986280#M49255

Regards,
Ferdinando

[FerdinandG]

Nah, I'm using syslog-ng running on a FreeBSD server. I also don't quite see how the type of syslog server would impact the size of vCenter logs? I mean, it's just sending syslog messages via UDP after all? 🫤