Portal Home > Knowledgebase > VMware Knowledge Base > Configuring syslog logging for hostd and vpxa management agents on ESX/ESXi

Configuring syslog logging for hostd and vpxa management agents on ESX/ESXi

Purpose

The hostd and vpxa management agents on VMware ESX/ESXi 3.5–4.1can be configured to direct their logs to the local syslog daemon in addition to their own local logging in the /var/log/vmware/ directory.

Caution: The management agents log verbosely. Directing management agent logs to the local syslog facilities may cause/var/log/messages to fill and rotate quickly. This may impair the ability to troubleshoot issues. VMware recommends that you use this configuration only if the local syslog service on ESX/ESXi has been configured to route logging messages over the network to a remote syslog log collector.

For more information on configuring an ESX or ESXi host to log to a remote syslog collector, see Logging ESX host events to a remote syslog server (1005030) or Enabling syslog on ESXi (1016621).

The defaults may not be appropriate under some circumstances. For example:

  • ESX with remote syslog services. The remote syslog service could facilitate analysis or persistent storage of management agent logs centrally, in addition to kernel logs.

  • ESXi with no remote syslog services. The local syslog daemon will store and rotate 8MB of logs, which will be exhausted quickly by verbose management agent logs. For example, see The vpxa management agent fills local logs in ESXi 4.1 (1030672).

The verbosity of each component is controlled within the same configuration file. For more information on changing the logging level for management agents, see Increasing vCenter Server and ESX logging levels (1004795).

Resolution

The routing of hostd and vpxa management agent logging to the local syslog service is controlled by a pair of configuration files.

Note: Changing the configuration requires restarting the management agents. Review Restarting the Management agents on an ESX or ESXi Server (1003490) before making any configuration change.

The default configuration differs between ESX and ESXi, and between versions. The hostd management agent logs to syslog by default in ESXi 3.5–4.1, and does not in ESX 3.5–4.1. The vpxa management agent logs to syslog by default on ESXi managed by vCenter Server 4.1 and higher, and does not for earlier versions of vCenter Server or any version of ESX.

This functionality can be enabled or disabled individually for hostd and vpxa on ESX/ESXi 3.5 or higher by modifying an XML configuration file for each management agent. The configuration file can be copied off-host using the vifs.pl vSphere Command-Line Interface utility, modified locally, and copied back. Alternatively, the file can be modified in-place from the console of the ESX host. For more information on the options, see Editing configuration files in VMware ESX (1017022).

To change the configuration for one of the agents:

  1. Open the management agent configuration file in a text editor. If you are using vCLI vifs.pl or another remote method, copy the configuration file from the ESX/ESXi host. For more information, see Editing configuration files in VMware ESX (1017022).

    • hostd management agent
      • Configuration file is located at /etc/vmware/hostd/config.xml
      • Exposed via API and vCLI as /host/hostAgentConfig.xml

    • vpxa management agent
      • Configuration file is located at /etc/opt/vmware/vpxa/vpxa.cfg
      • Exposed via API and vCLI as /host/vpxa.cfg

  2. Locate the  section within  in the configuration file. For example:


      ...
     
        ...
        verbose
        ...

  3. Add or modify 5 lines within the  section of the configuration file, specifying three options:

    • /config/log/outputToSyslog - whether the management agent will log to syslog. Use true or false.
    • /config/log/syslog/ident - the service identifier which will be prefixed on each log message. Use Hostd orVpxa.
    • /config/log/syslog/facility - the syslog facility that will be assigned to each log message. Use local3 for ESX 3.5, and local4 for all other versions of ESX/ESXi.

      Note: On ESX 3.5, the local4 facility is utilized by storageMonitor. Use local3 instead. For more information, see the Investigating issues within the SCSI layer using storageMonitor section of Basic SCSI Storage Troubleshooting (1010213).

    Note: For agent versions which do not output to syslog by default, these tags are not present in the configuration file and must be added.

    For example:


      ...
     
        ...
        verbose

        true
       
          Hostd
          local4
       

     


  4. Save the configuration file. If you are using vCLI vifs.pl or another remote method, copy the modified configuration file back to the ESX/ESXi host.

  5. On ESXi, the configuration change is backed up at shutdown or on the hour. To save the configuration change immediately, use the TSM console to run the command:

    /sbin/auto-backup

  6. Restart the management agent to reload the configuration. For more information, see Restarting the Management agents on an ESX or ESXi Server (1003490).
Based on VMware KB 1017658

Also Read

Language: