The hostd and vpxa management agents on VMware ESXi/ESX 3.5 to 4.1 can be configured to direct their logs to the local syslog daemon in addition to their own local logging in the /var/log/vmware/ directory.

Caution: The management agents log verbosely. Directing management agent logs to the local syslog facilities may cause /var/log/messages to fill and rotate quickly. This may impair the ability to troubleshoot issues. VMware recommends that you use this configuration only if the local syslog service on ESXi/ESX has been configured to route logging messages over the network to a remote syslog log collector.

For more information on configuring an ESXi/ESX host to log to a remote syslog collector, see Enabling syslog on ESX (1005030) or Enabling syslog on ESXi 3.5 and 4.x (1016621).

The defaults may not be appropriate under some circumstances. For example:

• ESX with remote syslog services. The remote syslog service could facilitate analysis or persistent storage of management agent logs centrally, in addition to kernel logs.
  
  
• ESXi with no remote syslog services. The local syslog daemon will store and rotate 8 MB of logs, which will be exhausted quickly by verbose management agent logs. For example, see The vpxa management agent fills local logs in ESXi 4.1 (1030672).

The verbosity of each component is controlled within the same configuration file. For more information on changing the logging level for management agents, see Increasing vCenter Server and ESXi/ESX logging levels (1004795).

Symptoms:

VMware ESX 4.0.x
VMware ESX 4.1.x
VMware ESXi 4.1.x Embedded
VMware ESX Server 3.5.x
VMware ESXi 4.1.x Installable
VMware ESXi 4.0.x Embedded
VMware ESXi 4.0.x Installable
VMware ESXi 3.5.x Embedded
VMware ESXi 3.5.x Installable

The routing of hostd and vpxa management agent logging to the local syslog service is controlled by a pair of configuration files.

Note: Changing the configuration requires restarting the management agents. Review Restarting the Management agents on an ESXi or ESX host (1003490) before making any configuration change.

The default configuration differs between ESX and ESXi, and between versions. The hostd management agent logs to syslog by default in ESXi 3.5 to 4.1, and does not in ESX 3.5 to 4.1. The vpxa management agent logs to syslog by default on ESXi managed by vCenter Server 4.1 and higher, and does not for earlier versions of vCenter Server or any version of ESX.

This functionality can be enabled or disabled individually for hostd and vpxa on ESXi/ESX 3.5 or higher by modifying an XML configuration file for each management agent. The configuration file can be copied off-host using the vifs.pl vSphere Command Line Interface utility, modified locally, and copied back. Alternatively, the file can be modified in-place from the console of the ESX host. For more information on the options, see Editing configuration files in VMware ESXi and ESX (1017022).

To change the configuration for one of the agents:

1. Open the management agent configuration file in a text editor. If you are using vCLI vifs.pl or another remote method, copy the configuration file from the ESXi/ESX host. For more information, see Editing configuration files in VMware ESXi and ESX (1017022).
   
   
   • hostd management agent
     • Configuration file is located at /etc/vmware/hostd/config.xml
     • Exposed via API and vCLI as /host/hostAgentConfig.xml
       
       
   • vpxa management agent
     
     • Configuration file is located at /etc/opt/vmware/vpxa/vpxa.cfg
     • Exposed via API and vCLI as /host/vpxa.cfg
   
   
2. Locate the <log> section within <config> in the configuration file. For example:
   
   <config>
...
<log>
...
<level>verbose</level>
...
   
   
3. Add or modify 5 lines within the <log> section of the configuration file, specifying three options:
   
   
   • /config/log/outputToSyslog
     
     Whether the management agent will log to syslog. Use true or false.
     
     
   • /config/log/syslog/ident
     
     The service identifier which will be prefixed on each log message. Use Hostd or Vpxa.
     
     
   • /config/log/syslog/facility
     
     The syslog facility that will be assigned to each log message. Use local3 for ESX 3.5, and local4 for all other versions of ESXi/ESX.
     
     Note: On ESX 3.5, the local4 facility is utilized by storageMonitor. Use local3 instead.
     
   
   Note: For agent versions which do not output to syslog by default, these tags are not present in the configuration file and must be added.
   
   For example:
   
   <config>
...
<log>
...
<level>verbose</level>

<outputToSyslog>true</outputToSyslog>
<syslog>
<ident>Hostd</ident>
<facility>local4</facility>
</syslog>

</log>
   
   
4. Save the configuration file. If you are using vCLI vifs.pl or another remote method, copy the modified configuration file back to the ESXi/ESX host.
   
   
5. On ESXi, the configuration change is backed up at shutdown or on the hour. To save the configuration change immediately, use the TSM console to run the command:
   
   /sbin/auto-backup
   
   
6. Restart the management agent to reload the configuration. For more information, see Restarting the Management agents on an ESXi or ESX host (1003490).

Note: In ESXi 4.1 Update 2 and later releases, vpxa and hostd logs are not written to /var/log/messages . You can enable this by setting logall=non_zero_value in the file /etc/syslog.conf and restarting the syslogd service. For example, to revert to the previous behavior, add the option logall=1 to /etc/syslog.conf. For more information, see The vpxa management agent fills local logs in ESXi 4.1(1030672).

For more information on configuring an ESXi/ESX host to log to a remote syslog collector, see Enabling syslog on ESX (1005030) or Enabling syslog on ESXi 3.5 and 4.x (1016621).

For information regarding logging in ESXi 4.1, see The vpxa management agent fills local logs in ESXi 4.1 (1030672).


Restarting the Management agents in ESXi
Increasing VMware vCenter Server and VMware ESX/ESXi logging levels
Enabling syslog on ESX
Enabling syslog on ESXi 3.5 and 4.x
Editing configuration files in VMware ESXi and ESX
The vpxa management agent fills local logs in ESXi 4.1
ESXi/ESX で hostd および vpxa 管理エージェントの syslog ログを構成する
为 ESXi/ESX 上的 hostd 和 vpxa 管理代理配置 syslog 日志记录