vCenter Server Appliance 5.5 Syslog Collector Rotation

VMware vCenter Server has been shipping with an optional syslog collector for quite some time now, and has proven to be easy way to retain non-persistent logs from ESXi hosts.

The Windows Server variant of vCenter Server ships with a basic syslog collector, that can be optionally integrated into vCenter as a service, allowing you to do the following:

  • Pull syslog data into support bundles for better troubleshooting.
  • See what hosts are actively logging data to the collector.
  • See active configurations for the service, such as maximum log size, rotation, and log directory.

The Appliance variant of vCenter Server, based on SLES 11, DOES ship with a built in syslog collector, which is pre-installed and enabled; however, this variant does NOT have feature parity with the Windows version.

Instead, the Appliance ships with a variant of syslog-ng, and can not be integrated into vCenter as a service, meaning you lose the plugin visibility and functionality described above.

To pile on to this, it also does not come with Rotation pre-configured. This presents a large problem for those depending on vCenter Syslog to maintain copies of their non-persistent logs.

This is especially nasty, as the partition, /dev/sdb2, is in the middle of a non-dedicated disk, making it difficult to expand, and ships only at 20 GB.

To work around this limitation, you will need to configure rotation, which is quite easy, as logrotate.d is already configured as an active cronjob.

To enable basic log rotation, SSH to vCenter Server Appliance, Navigate to /etc/logrotate.d, and modify “syslog” to include the following statements:

/var/log/remote/*/*/* {
rotate 14
/etc/init.d/syslog-collector reload > /dev/null