ESXi 4.1 maintains a log of activity in log files, using a syslog facility. The
following logs are available:
• hostd.log
• messages
• vpxa.log (only if the host has been joined to a VirtualCenter instance)
By default, the messages log on ESXi are stored only in the in-memory file system. The logs are lost upon reboot, and only 1 day’s worth of logs are stored.
According to VMware Security Hardening Guide you can configure persistent logging to a datastore and a dedicated records of server activity are available for that host always.
VMware kb has recommendations about how to make it possible. But manual changes in 07.logger file work only for current session. After restart all changes reverted (kb has note about this). David note in this thread explains this issue. But how to resolve it and make possible persistent logging? Well, yes, vSphere Client works perfect and you can change syslog settings there. But I need to change it from TSM.
I have tried to edit '/etc/syslog.conf' file and it works! Between vSphere Client stores its changes for syslog settings in this file also.
So you need to:
- set your path to log file with 'logfile=' parameter. ie
logfile=/vmfs/volumes/4d5abbeb-22518c58-5ddc-000c2954a30d/logging/messagesX
where '4d5abbeb-22518c58-5ddc-000c2954a30d' is your storeID. You can use datastore label also (like "datastore1") in this path. Be sure that all folders in this path exist.
- find existing syslogd process and restart it:
ps | grep syslog > PID of syslogd
kill -HUP $syslogPID (restart process with selected PID)
Check that syslogd logs in the new file. Keep in mind that it continues to log in original "messages" file also (/var/log/messages). New log file is rotated and old versions are compressed automatically.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.