Syslog Server storage logs size calculation

Posted on Updated on


Syslog Server storage calculation:
I want to modify the settings so that my logs size is upped from 2mb to 10mb and we rotate after 40 logs not 20.Here we need to do some planning to see if we have enough free space.

Count hosts: 100
Current size log max: 2
Current rotation count: 20
Total possible MB used: 100x2x20 = 4,000MB  (4gb)

Count hosts: 100
Desired size log max: 10
Desired  rotation count: 40
Total possible MB used: 100x10x40=40,000MB (40GB)

So the drive where your logs are stored would need 40gbfree in the above example to be able to service future demands.
How to modify the VMware Syslog Collector configuration after it is installed:

  1. Make a backup of the file:vCenter Server 5.5 and lower%PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml
    vCenter Server 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
  2. Open the copied file using a text editor.
  3. Under <defaultValues>, change any of the options to the required values.For example, to increase the log file size to 10 MB and to decrease the number of files retained to 20, modify the attributes:<defaultValues>
<port>514</port>
<protocol>TCP,UDP</protocol>
<maxSize>10</maxSize>
<rotate>20</rotate>
<sslPort>1514</sslPort>

</defaultValues>Note: This configuration in vCenter Server overrides the ESXi host configuration file.

  1. Save and close the file.
  2. Stop the VMware Syslog Collector service.
  3. Remove the file:

    vCenter Server 5.5 and lower
    %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml
    vCenter Server 6.0%PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
  4. Rename the copy of the modified file to:vCenter Server 5.5 and lower%PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml
    vCenter Server 6.0%PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
  5. Start the VMware Syslog Collector service. It may be required to restart the syslog service on the ESXi host if logs are no longer updating on the Syslog Server. To restart the syslog service, see VMware ESXi 5.x host stops sending syslogs to remote server (2003127).

 

The maximum supported number of hosts for use with each vSphere Syslog Collector instance is 30, however depending on the load generated by your environment, you may encounter issues below this number.

To work around this issue, you can deploy multiple instances of vSphere Syslog Collector on separate Windows machine which allows you to distribute the load.

If the customer wishes to continue using vSphere Syslog Collector with more than 30 hosts (current maximum for syslog collector). There are no plans to increase the supported number of hosts. The windows event log error does not apply to the appliance, in some instances we receive no error message but the service simply stops responding or collecting logs.
Alternatively, investigate a more scalable solution such a VMware vRealize Log Insight.
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s