Search the VMware Knowledge Base (KB)
View by Article ID

Filtering logs in VMware vSphere ESXi (2118562)

  • 1 Ratings

Purpose

In VMware vSphere ESXi 6.0, the ability to filter or exclude logging expressions from the system logs was introduced. This article provides information on filter or excluding specific logging expressions from the system logs. This process is useful for removing trivial or informational logging event from the system logs.

Resolution

Caution: VMware does not recommend reducing logging as it may make it impossible to properly troubleshoot potential future issues.  

To enable log filtering and exclude a log expression:
  1. Log in to the VMware vSphere ESXi 6.0 host as root via console or SSH.
  2. Run this command to save the original vmsyslog.conf:

    cp /etc/vmsyslog.conf /etc/vmsyslog.orig

  3. Using a text editor, open the /etc/vmsyslog.conf and add the line:

    enable_logfilters = true

  4. Save the file.
  5. Using a text editor, open the /etc/vmware/logfilters file and add the log expression to exclude using the format:

    numLogs | ident |  logRegexp

    Values:

    numLogs
    - This value is the number of times the log entry can appear before it is filtered and excluded from system logs.

    Note: By setting this value to zero, the expression defined will be suppressed from the system logs. Values greater than zero will result in the suppressing the expression defined when repeated in close proximity within the system logs.

    ident - This value is used to identify the originating location of the log expression. For more information, see the /etc/vmsyslog.conf.d/*.conf files for all available values.
    logRegexp - This value is used to define the log expression to exclude conforming to the Python regular expression syntax.

    Example:

    Some rescan commands for local storage devices will report a SCSI log expression in the vmkernel.log that can be safely filtered.

    Below is an example of the logfilters file including these expressions:

    0 | vmkernel | 0x1a.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x2[04] 0x0
    0 | vmkernel | 0x85.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0
    0 | vmkernel | 0x12.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x24 0x0
    0 | vmkernel | 0x9e.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0
    0 | vmkernel | bad CDB .* scsi_op=0x9e
    0 | vmkernel | 0x4d.* H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0

  6. Save the file.
  7. Run this command to reload the syslog service and apply the log filter:

    esxcli system syslog reload

See Also

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 1 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)




Please enter the Captcha code before clicking Submit.
  • 1 Ratings
Actions
KB: