We have diskless Hosts and we configure a remote scratch partition on a shared datastore. We also use the vCenter server as a remote syslog repository as well as another security server. A question came up about the "syslog.global.logdir". There was discussion of what should be defined here. One engineer was wanting to explicitly define this field with the remote scratch partition location while another suggested the default.
Can someone explain precisley where syslogs would be placed with each of the configurations below?
syslog.global.loghost 10.X.X.X,10.Y.Y.Y:514
syslog.global.defaultrotate 32
syslog.global.defaultsize 4096
syslog.global.logdir []/scratch/log
syslog.global.logdirunique true (checked)
syslog.global.loghost 10.X.X.X,10.Y.Y.Y:514
syslog.global.defaultrotate 32
syslog.global.defaultsize 4096
syslog.global.logdir [NFS-Datastore-1]/ESXiScratch/
syslog.global.logdirunique true (checked)
If you have already configured the scratch location (scratchconfig.configuredscratchlocation) and rebooted the host, all the syslog files will already be put on the specified datastore. Also setting the syslog.global.logdir to the datastore isn't needed.
On diskless hosts, /scratch is a symlink to /tmp/scratch. That same tmp folder is saved in memory. Which means, with a powercycle or reboot of the ESXi hosts, you lose all this information stored in /tmp.
~ # ls -allh scratch
lrwxrwxrwx 1 root root 12 Sep 14 22:33 scratch -> /tmp/scratch
One big advantage of configuring the syslog.global.logdir towards the NFS datastore is the preservation of the logs on the moment that the ESXi host is rebooted or powercycled.
On servers where ESXi is installed on a local disk, the /scratch folder is configured automatically during installation (or first boot) of the ESXi host. On a local disk with sufficient space, a partition is automatically created.
~ # ls -allh scratch
lrwxrwxrwx 1 root root 49 Jan 8 17:12 scratch -> /vmfs/volumes/5274f80b-ddd3ac19-e28b-a820661e2e1c
Thanks. I guess my question is if we already define the scratch partion as [NFS-Datastore-1]/ESXiScratch with the "ScratchConfig.ConfiguredScratchLocation" configuration option won't syslog already be put there without defining it in "syslog.global.logdir"?
If you have already configured the scratch location (scratchconfig.configuredscratchlocation) and rebooted the host, all the syslog files will already be put on the specified datastore. Also setting the syslog.global.logdir to the datastore isn't needed.
Thanks. That's what I needed to confirm. I suppose it wouldn't hurt to set it but I prefer leaving default seetings where modfications to them are unnecessary.
Sure, I agree with you on customizing settings that aren't really neccessary. You can mark answers as helpful or correct if you'd like.
the way we set it up (all diskless ESXis)
syslog.global.logdir [datastore] <Logfile directory>
syslog.global.logdirunique true (checked)
Please notice on forward/backward slash and it works all good for us