vCenter Appliance syslog rotation

[Tom_NL]

Hi,

In the normal Windows based vCenter, there are options to set log rotation settings for the syslog service to which the ESXi-hosts are logging.

I can't find this option in the vCenter Appliance. Does it do this automatically? Or do I need to do manual scripting for this?

[a_p_]

Please take a look at virtuallyGhetto: Forwarding vCenter Server Logs to a Syslog Server to see whether this answers your question. Basically there's no need to take care about log rotation in the appliance due to symlinks pointing to the current log files.

André

[Tom_NL]

That article is about sending log files from the vCenter Appliance to a remote syslog server. That's not what i'm looking for.

I'm redirecting the ESXi logfiles to the build in syslog functionality in the vCenter Appliance. See this article: http://kb.vmware.com/kb/2003322

[oturn]

Any news on this? We're in the process directing all host syslog files to our vCenter Server Appliance. Within a week or two, logging on the appliance filled up. Surely there are retention policies that can be set on the appliance? The policies directly on the ESXi hosts don't apply to the syslog server. We would rather not have to deal with expanding or adding storage on the appliance.

[AKInfra]

This is how I have configured the vCenter Appliance to rotate the syslogs from my ESXi hosts.  I'm not sure if these changes are supported by VMware, or if they survive an upgrade, so buyer beware.

1. Backup the syslog-collector.conf configuration file.

   cp /etc/syslog-ng/syslog-collector.conf /etc/syslog-ng/syslog-collector.conf.orig
   

2. Edit syslog-collector.conf and change the file format:

   file("/var/log/remote/$HOST_FROM/messages"
   

3. Reload syslog-collector service.

   /etc/init.d/syslog-collector reload
   

If you use the same file format as I have then you should now have a messages file for each host under /var/log/remote/hostname.  I use the following config file to rotate the logs daily:

/etc/logrotate.d/syslog-remote

/var/log/remote/*/messages {
  daily
  compress
  delaycompress
  rotate 14
  postrotate
    /etc/init.d/syslog-collector reload > /dev/null
  endscript
}

[oturn]

Thank you for this!

Can you explain further how the syslog-remote file works? We have bz2 files that have a weeks worth of logs so far.

[AKInfra]

rotate 14

will keep the compressed files for 14 days.  Reduce the number to however many days worth of logs you want to keep.

See the logrotate documentation for an explanation of all the values:

http://linux.die.net/man/8/logrotate

[conresjkozej]

Check this link out for help. I think it contains the answer for what you are looking for.

http://vdoogle.wordpress.com/2014/07/14/vcenter-server-appliance-5-5-syslog-collector-rotation/