Knowledge Base

The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides
 
Search the VMware Knowledge Base (KB)   View by Article ID
 

Configuring syslog logging for hostd and vpxa management agents on ESXi/ESX (1017658)

Purpose

The hostd and vpxa management agents on VMware ESXi/ESX 3.5 to 4.1 can be configured to direct their logs to the local syslog daemon in addition to their own local logging in the /var/log/vmware/ directory.

Caution: The management agents log verbosely. Directing management agent logs to the local syslog facilities may cause /var/log/messages to fill and rotate quickly. This may impair the ability to troubleshoot issues. VMware recommends that you use this configuration only if the local syslog service on ESXi/ESX has been configured to route logging messages over the network to a remote syslog log collector.

For more information on configuring an ESXi/ESX host to log to a remote syslog collector, see Enabling syslog on ESX (1005030) or Enabling syslog on ESXi 3.5 and 4.x (1016621).

The defaults may not be appropriate under some circumstances. For example:
  • ESX with remote syslog services. The remote syslog service could facilitate analysis or persistent storage of management agent logs centrally, in addition to kernel logs.

  • ESXi with no remote syslog services. The local syslog daemon will store and rotate 8 MB of logs, which will be exhausted quickly by verbose management agent logs. For example, see The vpxa management agent fills local logs in ESXi 4.1 (1030672).
The verbosity of each component is controlled within the same configuration file. For more information on changing the logging level for management agents, see Increasing vCenter Server and ESXi/ESX logging levels (1004795).

Resolution

The routing of hostd and vpxa management agent logging to the local syslog service is controlled by a pair of configuration files.

Note: Changing the configuration requires restarting the management agents. Review Restarting the Management agents on an ESXi or ESX host (1003490) before making any configuration change.

The default configuration differs between ESX and ESXi, and between versions. The hostd management agent logs to syslog by default in ESXi 3.5 to 4.1, and does not in ESX 3.5 to 4.1. The vpxa management agent logs to syslog by default on ESXi managed by vCenter Server 4.1 and higher, and does not for earlier versions of vCenter Server or any version of ESX.

This functionality can be enabled or disabled individually for hostd and vpxa on ESXi/ESX 3.5 or higher by modifying an XML configuration file for each management agent. The configuration file can be copied off-host using the vifs.pl vSphere Command Line Interface utility, modified locally, and copied back. Alternatively, the file can be modified in-place from the console of the ESX host. For more information on the options, see Editing configuration files in VMware ESXi and ESX (1017022).

To change the configuration for one of the agents:

  1. Open the management agent configuration file in a text editor. If you are using vCLI vifs.pl or another remote method, copy the configuration file from the ESXi/ESX host. For more information, see Editing configuration files in VMware ESXi and ESX (1017022).

    • hostd management agent
      • Configuration file is located at /etc/vmware/hostd/config.xml
      • Exposed via API and vCLI as /host/hostAgentConfig.xml

    • vpxa management agent
      • Configuration file is located at /etc/opt/vmware/vpxa/vpxa.cfg
      • Exposed via API and vCLI as /host/vpxa.cfg

  2. Locate the <log> section within <config> in the configuration file. For example:

    <config>
      ...
      <log>
        ...
        <level>verbose</level>
        ...


  3. Add or modify 5 lines within the <log> section of the configuration file, specifying three options:

    • /config/log/outputToSyslog

      Whether the management agent will log to syslog. Use true or false.

    • /config/log/syslog/ident

      The service identifier which will be prefixed on each log message. Use Hostd or Vpxa.

    • /config/log/syslog/facility

      The syslog facility that will be assigned to each log message. Use local3 for ESX 3.5, and local4 for all other versions of ESXi/ESX.

      Note: On ESX 3.5, the local4 facility is utilized by storageMonitor. Use local3 instead. For more information, see the Investigating issues within the SCSI layer using storageMonitor section of Basic SCSI Storage Troubleshooting (1010213).

    Note: For agent versions which do not output to syslog by default, these tags are not present in the configuration file and must be added.

    For example:

    <config>
      ...
      <log>
        ...
        <level>verbose</level>

        <outputToSyslog>true</outputToSyslog>
        <syslog>
          <ident>Hostd</ident>
          <facility>local4</facility>
        </syslog>

      </log>


  4. Save the configuration file. If you are using vCLI vifs.pl or another remote method, copy the modified configuration file back to the ESXi/ESX host.

  5. On ESXi, the configuration change is backed up at shutdown or on the hour. To save the configuration change immediately, use the TSM console to run the command:

    /sbin/auto-backup

  6. Restart the management agent to reload the configuration. For more information, see Restarting the Management agents on an ESXi or ESX host (1003490).

Note: In ESXi 4.1 Update 2 and later releases, vpxa and hostd logs are not written to /var/log/messages . You can enable this by setting logall=non_zero_value in the file /etc/syslog.conf and restarting the syslogd service. For example, to revert to the previous behavior, add the option logall=1 to /etc/syslog.conf. For more information, see The vpxa management agent fills local logs in ESXi 4.1(1030672).

Additional Information

For more information on configuring an ESXi/ESX host to log to a remote syslog collector, see Enabling syslog on ESX (1005030) or Enabling syslog on ESXi 3.5 and 4.x (1016621).

For information regarding logging in ESXi 4.1, see The vpxa management agent fills local logs in ESXi 4.1 (1030672).


See Also

Update History

10/22/2012 - Added link to vpxa management fills local logs. 05/17/2013 - Updated vpxa management location.

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 7 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (4000 or fewer characters)
  • 7 Ratings
Actions
KB: