Syslog Server storage calculation:
I want to modify the settings so that my logs size is upped from 2mb to 10mb and we rotate after 40 logs not 20.Here we need to do some planning to see if we have enough free space.
Count hosts: 100
Current size log max: 2
Current rotation count: 20
Total possible MB used: 100x2x20 = 4,000MB (4gb)
Count hosts: 100
Desired size log max: 10
Desired rotation count: 40 Total possible MB used: 100x10x40=40,000MB (40GB)
So the drive where your logs are stored would need 40gbfree in the above example to be able to service future demands. How to modify the VMware Syslog Collector configuration after it is installed:
Make a backup of the file:vCenter Server 5.5 and lower: %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml vCenter Server 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
Open the copied file using a text editor.
Under <defaultValues>, change any of the options to the required values.For example, to increase the log file size to 10 MB and to decrease the number of files retained to 20, modify the attributes:<defaultValues>
</defaultValues>Note: This configuration in vCenter Server overrides the ESXi host configuration file.
Save and close the file.
Stop the VMware Syslog Collector service.
Remove the file:
vCenter Server 5.5 and lower: %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml vCenter Server 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
Rename the copy of the modified file to:vCenter Server 5.5 and lower: %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml vCenter Server 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
The maximum supported number of hosts for use with each vSphere Syslog Collector instance is 30, however depending on the load generated by your environment, you may encounter issues below this number.
To work around this issue, you can deploy multiple instances of vSphere Syslog Collector on separate Windows machine which allows you to distribute the load.
If the customer wishes to continue using vSphere Syslog Collector with more than 30 hosts (current maximum for syslog collector). There are no plans to increase the supported number of hosts. The windows event log error does not apply to the appliance, in some instances we receive no error message but the service simply stops responding or collecting logs.