I frequently get questions around how to forward only certain log files from ESXi or how to collect a log file that is missing. I get the question so frequently that it warrants a quick post. The title of this post says it all – it’s all or nothing. If you configure remote syslog on ESXi then you will get all configured logs files from ESXi. There is no supported way today to customize what logs files are stored locally versus sent remotely. The only customization that you can make is what severity logs messages are forwarded to the remote syslog destinations by changing log verbosity, however this is not recommended (read here for more information).
In case you missed it, William Lam recently put up a couple of excellent posts on how to configure some important vCenter Server alarms. As it turns out, the underlying VOB (VMkernel Observation) messages appear in vSphere logs and if your are running Log Insight you can easily check for environmental issues such as the ones he outlined.
A long time ago, I talked about an internal error messages I received on ESXi. The workaround was to reboot the ESXi host, which is not the best outcome in my opinion. Recently, I hit this issue again, but this time specific to trying to configure remote syslog. I saw this issue will configuring vSphere integration on Log Insight and would like walk through the steps I took to address the issue.
I hit an interesting issue the other day when attempting to reconfigure remote syslog on some ESXi hosts. What followed was an exercise on troubleshooting remote syslog on an ESXi host and I wanted to share some tips.
I ran into a frustrating issue the other day when attempting to add multiple new virtual disks to an existing VM. Upon doing so, I received the dreaded “Operating System not found” message when the VM was started. While the underlying issue was easy to discover, the way to fix the problem became tedious due to issues with the vSphere web client. This post contains some tips and tricks to make the process easier.
A while back, I came across an entry from Michael White’s newsletter about changing VMware ESXi host logging levels:
Changing VMware ESXi host logging level
Someone was talking about doing this, and using this as a guide, but I would like to say you may not want to do this. There may be a reason for the log levels, and if you change them it may be harder to support you if you call VMware for help. And your syslog of choice should be able to handle the volume and I know – in fact better than most – that ESXi logs are noisy, but you can deal with that with good searching.
I completely agree with Michael and this post will explain why.
One of the great features of Log Insight is its tight integration with other VMware products. One of these integrations is with vSphere. I have talked about vSphere integration in the past, however I would like to do so in more details to clear up some questions I have received lately.