{"id":1779,"date":"2026-01-19T23:20:41","date_gmt":"2026-01-20T05:20:41","guid":{"rendered":"https:\/\/zewwy.ca\/?p=1779"},"modified":"2026-01-19T23:42:12","modified_gmt":"2026-01-20T05:42:12","slug":"vcenter-syslog-rsyslog","status":"publish","type":"post","link":"https:\/\/zewwy.ca\/index.php\/2026\/01\/19\/vcenter-syslog-rsyslog\/","title":{"rendered":"vCenter syslog\/rsyslog"},"content":{"rendered":"

So, in my previous post I discussed troubleshooting the wd in wdpath already exists log error. However, the root issue there may have been determined and resolved… but the question arises… do we need to ship that much logs?<\/p>\n

What are all these log files for?<\/p>\n

<\/span>High\u2011Level Overview<\/span><\/h1>\n

Every file listed is part of vCenter Server\u2019s syslog configuration<\/strong>. Each vmware-services-*.conf<\/code> file tells the syslog collector which logs belong to which internal service. These logs fall into categories like:<\/p>\n

    \n
  • UI \/ Client logs<\/strong><\/li>\n
  • SSO & Identity logs<\/strong><\/li>\n
  • vCenter core services (vpxd, vmon, vapi, etc.)<\/strong><\/li>\n
  • Database logs (Postgres, vtsdb)<\/strong><\/li>\n
  • vSAN Health<\/strong><\/li>\n
  • Networking (rhttpproxy, netdumper)<\/strong><\/li>\n
  • Appliance management (applmgmt, cloudvm)<\/strong><\/li>\n<\/ul>\n

    Below is a readable breakdown of what each group of log files does.<\/p>\n

    <\/span>\ud83d\udcd8 Detailed Breakdown by Service<\/span><\/h1>\n

    <\/span>\ud83c\udfa8 vSphere UI \/ HTML5 Client<\/strong><\/span><\/h2>\n

    Files under \/storage\/log\/vmware\/vsphere-ui\/logs\/<\/code><\/p>\n

    These logs cover everything related to the vSphere Client (the HTML5 UI):<\/p>\n

    \n
    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Log<\/th>\nPurpose<\/th>\n<\/tr>\n<\/thead>\n
    vsphere_client_virgo.log<\/code><\/td>\nMain UI application server (Virgo) log<\/td>\n<\/tr>\n
    changelog.log<\/code><\/td>\nUI plugin\/component change tracking<\/td>\n<\/tr>\n
    dataservice.log<\/code><\/td>\nBackend data service used by UI<\/td>\n<\/tr>\n
    apigw.log<\/code><\/td>\nAPI gateway for UI requests<\/td>\n<\/tr>\n
    equinox.log<\/code><\/td>\nOSGi framework logs<\/td>\n<\/tr>\n
    eventlog.log<\/code><\/td>\nUI event processing<\/td>\n<\/tr>\n
    httpRequest.log<\/code><\/td>\nHTTP request logs<\/td>\n<\/tr>\n
    opid.log<\/code><\/td>\nOperation IDs for tracing UI actions<\/td>\n<\/tr>\n
    performanceAudit.log<\/code><\/td>\nUI performance metrics<\/td>\n<\/tr>\n
    plugin-medic.log<\/code><\/td>\nPlugin health & validation<\/td>\n<\/tr>\n
    threadmonitor.log<\/code><\/td>\nThread health monitoring<\/td>\n<\/tr>\n
    threadpools.log<\/code><\/td>\nThread pool usage<\/td>\n<\/tr>\n
    vspheremessaging.log<\/code><\/td>\nMessaging subsystem<\/td>\n<\/tr>\n
    vsphere-ui-rpm.log<\/code><\/td>\nUI package\/runtime logs<\/td>\n<\/tr>\n
    vsphere-ui-runtime*<\/code><\/td>\nRuntime stdout\/stderr<\/td>\n<\/tr>\n
    access\/localhost_access_log.txt<\/code><\/td>\nWeb access logs<\/td>\n<\/tr>\n
    vsphere-ui-gc*<\/code><\/td>\nJava garbage collection<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n
    <\/div>\n

    <\/span>\ud83d\udd10 SSO \/ Identity Services<\/strong><\/span><\/h2>\n

    Files under \/storage\/log\/vmware\/sso\/<\/code>, \/storage\/log\/vmware\/vmdir\/<\/code>, \/storage\/log\/vmware\/vmafd\/<\/code><\/p>\n

    These logs relate to authentication, identity, certificates, and tokens:<\/p>\n

    \n
    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Log<\/th>\nPurpose<\/th>\n<\/tr>\n<\/thead>\n
    activedirectoryservice.log<\/code><\/td>\nAD integration<\/td>\n<\/tr>\n
    lookupsvc-init.log<\/code><\/td>\nLookup service initialization<\/td>\n<\/tr>\n
    openidconnect.log<\/code><\/td>\nOIDC authentication<\/td>\n<\/tr>\n
    ssoAdminServer.log<\/code><\/td>\nSSO admin operations<\/td>\n<\/tr>\n
    svcaccountmgmt.log<\/code><\/td>\nService account management<\/td>\n<\/tr>\n
    tokenservice.log<\/code><\/td>\nToken issuance<\/td>\n<\/tr>\n
    sts-health-status.log.*<\/code><\/td>\nSTS health<\/td>\n<\/tr>\n
    sts-runtime.log.*<\/code><\/td>\nSTS runtime<\/td>\n<\/tr>\n
    gclogFile.*.current<\/code><\/td>\nJVM GC<\/td>\n<\/tr>\n
    tomcat\/localhost_access.log<\/code><\/td>\nSSO Tomcat access<\/td>\n<\/tr>\n
    vmdir\/*.log<\/code><\/td>\nDirectory service (LDAP-like)<\/td>\n<\/tr>\n
    vmafd\/*.log<\/code><\/td>\nAuthentication framework<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    <\/span>\ud83e\udde9 vCenter Core Services<\/strong><\/span><\/h2>\n

    vpxd (vCenter Server daemon)<\/strong><\/p>\n

    These are commented out in your file, but normally include:<\/p>\n

      \n
    • vpxd.log<\/code> \u2014 main vCenter service log<\/li>\n
    • vpxd-profiler-*.log<\/code> \u2014 performance profiling<\/li>\n<\/ul>\n

      vmon<\/strong><\/p>\n

      Manages service lifecycle:<\/p>\n

        \n
      • vmon.log<\/code> \u2014 service manager log<\/span><\/li>\n
      • vmon-vapi-provider-0.log<\/code> \u2014 VAPI provider logs<\/span><\/li>\n<\/ul>\n

        vapi<\/strong><\/p>\n

        API endpoint logs:<\/p>\n

          \n
        • endpoint.log<\/code> \u2014 main API endpoint<\/span><\/li>\n
        • endpoint-access.log<\/code> \u2014 API access logs<\/span><\/li>\n
        • jetty.log<\/code> \u2014 Jetty web server<\/span><\/li>\n
        • vcentershim.log<\/code> \u2014 vCenter API shim<\/span><\/li>\n
        • vmodl2swagger.log<\/code> \u2014 API schema conversion<\/span><\/li>\n
        • vmware-vapi-endpoint-gc.log.*<\/code> \u2014 GC logs<\/span><\/li>\n
        • vmware-vapi-endpoint.std*<\/code> \u2014 stdout\/stderr<\/li>\n<\/ul>\n
          <\/div>\n

          <\/span>\ud83d\udcca Analytics \/ Telemetry<\/strong><\/span><\/h2>\n
            \n
          • analytics.log<\/code> \u2014 analytics service<\/span><\/li>\n
          • analytics-runtime.log.std*<\/code> \u2014 runtime logs<\/span><\/li>\n<\/ul>\n
            <\/div>\n

            <\/span>\ud83e\uddf1 vSAN Health<\/strong><\/span><\/h2>\n
              \n
            • vmware-vsan-health-service.log<\/code> \u2014 main vSAN health service<\/li>\n
            • vmware-vsan-health-runtime.log.*<\/code> \u2014 runtime logs<\/span><\/li>\n
            • vsanvcmgmtd-*.log<\/code> \u2014 vSAN cluster mgmt<\/li>\n<\/ul>\n
              <\/div>\n

              <\/span>\ud83d\uddc4\ufe0f Database Services<\/strong><\/span><\/h2>\n

              Postgres (vPostgres)<\/strong><\/code><\/p>\n

                \n
              • serverlog.std*<\/code> \u2014 main DB log<\/li>\n
              • postgresql-*.log<\/code> \u2014 DB engine<\/span><\/li>\n<\/ul>\n

                logsvtsdb<\/strong>
                \n<\/span><\/p>\n

                  \n
                • vtsdb-runtime.log.std*
                  \n<\/span><\/li>\n
                • runtime\u00a0 postgresql-*.log \u2014 DB logs<\/span><\/li>\n<\/ul>\n

                  Postgres Archiver<\/strong><\/p>\n

                    \n
                  • pg_archiver.log.std*<\/code> \u2014 WAL archiving<\/li>\n<\/ul>\n
                    <\/div>\n

                    <\/span>\ud83d\udd27 Lifecycle Manager (vLCM)<\/span><\/h2>\n
                      \n
                    • lcm_common.log \u2014 core LCM operations<\/li>\n
                    • task_executor.log \u2014 task execution<\/li>\n
                    • twisted_server.log \u2014 Python-based server<\/li>\n
                    • vlcm_db.log \u2014 LCM database<\/li>\n
                    • vlcm-runtime.log.* \u2014 runtime logs<\/li>\n<\/ul>\n
                      \n

                      <\/span>\ud83e\uddea vSphere ESX Agent Manager (EAM)<\/span><\/h2>\n
                        \n
                      • eam.log \u2014 main EAM service<\/li>\n
                      • web\/*.log \u2014 Tomcat logs<\/li>\n
                      • jvm.log.* \u2014 JVM logs<\/li>\n
                      • eam_firstboot.py*.log \u2014 first boot<\/li>\n<\/ul>\n<\/div>\n
                        \n

                        The EAM log refers to the log files generated by the VMware ESX Agent Manager (EAM) service.
                        \nEAM is a core vCenter component responsible for deploying and managing ESX agents, which are small helper VMs or services used by features such as:<\/p>\n

                        vSphere Lifecycle Manager (vLCM)
                        \nvSphere Storage I\/O Control
                        \nvSphere Network I\/O Control
                        \nvSAN \/ vCLS agents
                        \nThird\u2011party extensions that deploy agents to ESXi hosts<\/p>\n

                        Search results confirm that EAM logs live in \/var\/log\/vmware\/eam\/ and are used for diagnostics and troubleshooting.<\/p>\n

                        \ud83d\udcd8 What EAM logs contain<\/p>\n

                        1. eam.log \u2014 Main service log
                        \nThis is the primary log file for the ESX Agent Manager.<\/p>\n

                        It records:<\/p>\n

                        Service startup and shutdown
                        \nAgent deployment and lifecycle events
                        \nCommunication with vCenter and ESXi hosts
                        \nPlugin\/extension registration
                        \nErrors when EAM cannot deploy or manage agents
                        \nFailures related to vCLS or vSAN agent VMs
                        \nSearch results show examples of EAM startup failures and configuration errors logged in eam.log.<\/p>\n

                        2. Web access logs (web\/localhost_access.log)
                        \nThese track:<\/p>\n

                        HTTP requests to the EAM web service
                        \nMOB (Managed Object Browser) access
                        \nAPI calls from vCenter or extensions
                        \nMentioned in STIG guidance for EAM logging.<\/p>\n

                        3. JVM logs (jvm.log, wrapper.log)
                        \nThese capture:<\/p>\n

                        Java runtime errors
                        \nMemory issues
                        \nCrashes or fatal exceptions
                        \nExamples of JVM startup failures appear in VMware KB articles<\/p>\n<\/div>\n

                        <\/span>\ud83c\udf10 Networking & Proxy Services<\/strong><\/span><\/h2>\n

                        rhttpproxy<\/strong><\/p>\n

                          \n
                        • rhttpproxy-*.log<\/code> \u2014 reverse proxy logs<\/li>\n<\/ul>\n

                          netdumper<\/strong><\/p>\n

                            \n
                          • netdumer.log<\/code> \u2014 ESXi dump collector<\/li>\n
                          • webserver.log<\/code> \u2014 web interface<\/li>\n<\/ul>\n
                            <\/div>\n

                            <\/span>\ud83e\uddf0 Content Library<\/strong><\/span><\/h2>\n
                              \n
                            • cls.log<\/code> \u2014 content library service<\/li>\n<\/ul>\n

                              <\/span>\ud83d\udcc8 Perfcharts<\/span><\/h3>\n

                              stats.log \u2014 performance charts<\/p>\n

                                \n
                              • localhost_access_log.txt \u2014 access logs<\/li>\n
                              • vmware-perfcharts-gc.log.* \u2014 GC logs<\/li>\n
                              • vmware-perfcharts-runtime.log.std* \u2014 runtime<\/li>\n<\/ul>\n

                                <\/span>\ud83e\udded Lookup Service<\/span><\/h3>\n
                                  \n
                                • lookupserver-default.log \u2014 main lookup service<\/li>\n
                                • lookupServer.log \u2014 operations<\/li>\n
                                • lookupsvc_stream.log.std* \u2014 runtime<\/li>\n
                                • vmware-lookupservice-perf.log \u2014 performance<\/li>\n
                                • vmware-lookupsvc-gc.log.* \u2014 GC<\/li>\n<\/ul>\n

                                  <\/span>\ud83e\udde9 vpxd-svcs (vCenter Support Services)<\/span><\/h3>\n
                                    \n
                                  • vpxd-svcs.log \u2014 main<\/li>\n
                                  • authz-event.log \u2014 authorization events<\/li>\n
                                  • startup-error.log \u2014 startup failures<\/li>\n
                                  • vpxd-svcs-access*.log \u2014 access logs<\/li>\n
                                  • vpxd-svcs-runtime.log.* \u2014 runtime<\/li>\n
                                  • perf.log \u2014 performance<\/li>\n<\/ul>\n

                                     <\/p>\n

                                    <\/span>\ud83d\udee1\ufe0f Trust Management<\/span><\/h2>\n
                                      \n
                                    • trustmanagement-runtime.log.std* \u2014 runtime<\/li>\n
                                    • trustmanagement-svcs.log \u2014 trust services<\/li>\n
                                    • vmware-trustmanagement-gc.log.* \u2014 GC<\/li>\n<\/ul>\n

                                      \ud83d\udd10 Trust Management Service \u2014 Tight Summary<\/p>\n

                                      Trustmanagement is a core vCenter service that maintains the trust relationships between all internal components. It ensures that certificates, tokens, and service\u2011to\u2011service authentication are valid and secure.<\/p>\n

                                      What it handles:<\/p>\n

                                      Certificate chain validation
                                      \nTrust checks between vCenter services
                                      \nToken verification (STS\/SSO)
                                      \nSecurity posture and compliance signals<\/p>\n

                                      What its logs show:<\/p>\n

                                      Certificate or trust failures
                                      \nService registration\/authentication issues
                                      \nToken validation errors
                                      \nStartup\/shutdown and internal health<\/p>\n

                                      Why it matters:
                                      \nIf trustmanagement breaks, you may see:<\/p>\n

                                      vCenter login failures
                                      \nSTS token errors
                                      \nCertificate replacement problems
                                      \nServices stuck in \u201cNot Running\u201d
                                      \nUpgrade failures due to trust issues<\/p>\n

                                      What it does NOT do:<\/p>\n

                                      Track user logins
                                      \nRecord user actions
                                      \nProvide audit logs<\/p>\n

                                      It\u2019s purely about internal vCenter security plumbing, not end\u2011user activity.<\/p>\n

                                      <\/span>\ud83e\udde9 Pod Service<\/strong><\/span><\/h2>\n
                                        \n
                                      • pod-service.log<\/code> \u2014 pod mgmt<\/li>\n
                                      • pod-console.log<\/code> \u2014 console<\/li>\n
                                      • pod-startup.log<\/code> \u2014 startup<\/li>\n
                                      • pod-install*.log<\/code> \u2014 install<\/li>\n
                                      • pod-update*.log<\/code> \u2014 updates<\/li>\n<\/ul>\n

                                        <\/span>\ud83e\uddf0 Appliance Management (VAMI)<\/strong><\/span><\/h2>\n

                                        Files under \/storage\/log\/vmware\/applmgmt\/<\/code> covers:<\/p>\n

                                          \n
                                        • VAMI web UI<\/li>\n
                                        • Backup\/restore<\/li>\n
                                        • Firewall reload<\/li>\n
                                        • Stats monitor<\/li>\n
                                        • PNID changes<\/li>\n
                                        • Lighttpd access\/error logs<\/li>\n<\/ul>\n

                                          \ud83d\udd0d What the Applmgmt Upgrade Service does<\/p>\n

                                          It manages:<\/p>\n

                                          VCSA upgrade workflows
                                          \nPatch installation
                                          \nPre\u2011upgrade checks
                                          \nPost\u2011upgrade cleanup
                                          \nVersion validation
                                          \nUpgrade\u2011related service orchestration<\/p>\n

                                          It\u2019s the engine behind the VAMI (port 5480) upgrade process.<\/p>\n

                                          \ud83d\udcc1 What logs this syslog config points to<\/p>\n

                                          The file typically references logs such as:<\/p>\n

                                          applmgmt-upgrade.log \u2014 main upgrade workflow log
                                          \napplmgmt-upgrade-runtime.log.std* \u2014 stdout\/stderr
                                          \napplmgmt-upgrade-gc.log.* \u2014 Java garbage collection<\/p>\n

                                          These logs capture:<\/p>\n

                                          Upgrade steps and progress
                                          \nValidation checks
                                          \nErrors during patching or upgrading
                                          \nService restarts triggered by upgrades
                                          \nJVM runtime behavior<\/p>\n

                                          \ud83e\udded When these logs matter<\/p>\n

                                          You check these logs when:<\/p>\n

                                          A VCSA upgrade fails
                                          \nPatching stops mid\u2011process
                                          \nPre\u2011upgrade checks report errors
                                          \nThe VAMI UI shows upgrade failures
                                          \nServices don\u2019t come back after an upgrade<\/p>\n

                                          <\/div>\n

                                          <\/span>\ud83d\udd10 Certificate Management<\/strong><\/span><\/h2>\n
                                            \n
                                          • certificatemanagement-runtime.log.std *<\/code><\/li>\n
                                          • \u00a0certificatemanagement-svcs.log *<\/code><\/li>\n
                                          • vmware-certificatemanagement-gc.log.*<\/code><\/li>\n<\/ul>\n

                                            <\/span>\ud83e\udde9 SCA = Secure Configuration Assistant<\/span><\/h2>\n

                                            A vCenter subsystem responsible for security posture checks, certificate validation, and secure configuration enforcement.<\/p>\n

                                            It\u2019s part of the broader vCenter security framework that also includes:<\/p>\n

                                            Certificate Management (certmgmt)
                                            \nVMCA (VMware Certificate Authority)
                                            \nSTS (Security Token Service)
                                            \nPSC identity services (in older versions)<\/p>\n

                                            \ud83e\udde9 What SCA actually does<\/p>\n

                                            \ud83d\udee1\ufe0f 1. Security posture checks<\/p>\n

                                            It evaluates whether vCenter components are configured securely, including:<\/p>\n

                                            TLS\/SSL settings
                                            \nCertificate validity
                                            \nService trust relationships
                                            \nCryptographic compliance<\/p>\n

                                            \ud83d\udd0f 2. Certificate and trust validation<\/p>\n

                                            It works closely with:<\/p>\n

                                            VMCA
                                            \ncertmgmt
                                            \nSTS<\/p>\n

                                            to ensure that:<\/p>\n

                                            Certificates are valid
                                            \nTrust chains are intact
                                            \nServices can authenticate to each other<\/p>\n

                                            \ud83e\udded 3. Compliance reporting<\/p>\n

                                            SCA feeds data into:<\/p>\n

                                            vCenter security health checks
                                            \nvSphere Client \u201cSecurity\u201d view
                                            \nSome VAMI security status pages<\/p>\n

                                            \ud83d\udcc1 Where you see SCA in logs<\/p>\n

                                            You\u2019ll typically find SCA logs under:<\/p>\n

                                            Code
                                            \n\/storage\/log\/vmware\/sca\/
                                            \nCommon files include:<\/p>\n

                                            sca.log \u2014 main service log
                                            \nsca-runtime.log.std* \u2014 stdout\/stderr
                                            \nsca-gc.log.* \u2014 Java garbage collection<\/p>\n

                                            These logs show:<\/p>\n

                                            Security scan results
                                            \nCertificate validation failures
                                            \nTrust chain issues
                                            \nService authentication problems
                                            \nStartup\/shutdown of the SCA service<\/p>\n

                                            \ud83e\udded When SCA logs matter<\/p>\n

                                            You check SCA logs when:<\/p>\n

                                            vCenter shows certificate warnings
                                            \nServices fail to register due to trust issues
                                            \nYou see \u201cvCenter is not secure\u201d alerts
                                            \nSTS token problems appear<\/p>\n

                                            vCenter upgrades fail due to certificate or trust chain issues<\/p>\n

                                            <\/span>\ud83d\udee1\ufe0f File Integrity Service \u2014 Tight Summary<\/span><\/h2>\n

                                            The fileintegrity syslog config points to logs generated by vCenter\u2019s File Integrity Service, which monitors critical system files for unauthorized or unexpected changes.<\/p>\n

                                            What it does<\/p>\n

                                              \n
                                            • Checks hashes of important vCenter files<\/li>\n
                                            • Detects tampering, corruption, or unexpected modifications<\/li>\n
                                            • Flags security\u2011relevant integrity issues<\/li>\n<\/ul>\n

                                              What its logs contain<\/p>\n

                                                \n
                                              • Integrity scan results<\/li>\n
                                              • File change alerts<\/li>\n
                                              • Hash mismatches<\/li>\n
                                              • Service errors and startup info<\/li>\n
                                              • JVM runtime and memory behavior (via runtime + GC logs)<\/li>\n<\/ul>\n

                                                Why it matters<\/p>\n

                                                  \n
                                                • Helps detect compromise or corruption of vCenter<\/li>\n
                                                • Useful for SOC teams as security telemetry<\/li>\n
                                                • Not related to user activity or audit logging<\/li>\n<\/ul>\n

                                                  <\/span>\ud83e\uddf5 threadmonitor.log \u2014 Tight Summary<\/span><\/h2>\n

                                                  threadmonitor.log is part of the vSphere UI service (the HTML5 vSphere Client).
                                                  \nThis log tracks thread health and performance inside the UI service\u2019s Java application.
                                                  \nIt\u2019s essentially a watchdog that monitors whether internal threads are running normally or getting stuck.<\/p>\n

                                                  \ud83d\udd0d What it records<\/p>\n

                                                  Thread stalls or deadlocks
                                                  \nLong\u2011running or hung operations
                                                  \nUI service performance issues
                                                  \nThread pool exhaustion
                                                  \nJava exceptions related to thread execution
                                                  \nInternal timing or responsiveness problems<\/p>\n

                                                  It\u2019s a diagnostic log for the vsphere-ui backend, not for user activity.<\/p>\n

                                                  \ud83e\udded When this log matters<\/p>\n

                                                  You check threadmonitor.log when:<\/p>\n

                                                  The vSphere Client is slow or unresponsive
                                                  \nPages hang or fail to load
                                                  \nUI freezes during tasks
                                                  \nYou suspect backend thread starvation
                                                  \nThe vsphere-ui service crashes or restarts<\/p>\n

                                                  It\u2019s especially useful when troubleshooting UI performance issues.<\/p>\n

                                                  <\/span>Disable Unwanted Logs<\/span><\/h1>\n

                                                  This is obviously a balancing act between what you feel is needed to be forwarded, and what is not required depending on destination logging capabilities. Note comenting out these lines only stops the forwarding of the logs to the syslog destination, it does not stop the local logging of these services. That is out of scope of this blog post.<\/p>\n

                                                  \/etc\/vmware-syslog\/vmware-services-vsphere-ui.conf<\/strong><\/em><\/p>\n

                                                  Disable all except:
                                                  \nFile=”\/storage\/log\/vmware\/vsphere-ui\/logs\/access\/localhost_access_log.txt”<\/p>\n

                                                  \/etc\/vmware-syslog\/vmware-services-vmcad.conf<\/strong><\/em><\/p>\n

                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vmcad.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-sso-services.conf<\/strong><\/em><\/p>\n
                                                  just these:<\/p>\n
                                                  \/storage\/log\/vmware\/sso\/sts-health-status.log.* \/storage\/log\/vmware\/sso\/sts-runtime.log.* \/storage\/log\/vmware\/sso\/gclogFile.*.current \/storage\/log\/vmware\/sso\/tomcat\/localhost_access.log<\/div>\n
                                                  <\/div>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vsm.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/'\u00a0\/etc\/vmware-syslog\/vmware-services-vsm.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vpxd.conf<\/strong><\/em><\/p>\n
                                                  KEEP<\/strong><\/p>\n
                                                  \n
                                                  \n
                                                  \n
                                                  File=\"\/storage\/log\/vmware\/vpxd\/vpxd-*.log\"\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
                                                  There are a lot of vpxLRO logs generated by this, but there appears to no other granual controls at the source level (these rsyslog imfile config), so not sure about filtering these outside of transforms at the other syslog\/rsyslog\/lostash service that is receiving these logs.<\/p>\n
                                                  DISABLE<\/strong><\/p>\n
                                                  \n
                                                  \n
                                                  \n
                                                  File=\"\/storage\/log\/vmware\/vpxd\/vpxd-profiler-*.log\"<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
                                                  \/etc\/vmware-syslog\/vmware-services-infraprofile-syslog.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-infraprofile-syslog.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vmware-postgres-archiver.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vmware-postgres-archiver.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vsan-health.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vsan-health.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-envoy.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-envoy.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-sps.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-sps.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-analytics.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-analytics.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vcha.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vcha.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vmon.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vmon.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vstats.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vstats.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-certmgmt.conf<\/strong><\/em><\/p>\n
                                                  Disable these if you don’t want to see the certificate management stuff, could be useful in certain situations, configure per your own needs. For my testing I will disable them for now.<\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-certmgmt.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-eam.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-eam.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vapi.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vapi.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vtsdb.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vtsdb.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-observability.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-observability.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-cloudvm.conf<\/strong><\/em><\/p>\n
                                                  \/etc\/vmware-syslog\/vmware-services-cloudvm.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vlcm.conf<\/strong><\/em><\/p>\n
                                                  Lifecycle manager, if you need to log server update logs. I don’t for my case so I’ll disable them, this change is up to your needs<\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vlcm.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-pod.conf<\/strong><\/em><\/p>\n
                                                  Kubernetes, if you want to track that stuff. My case again, nope so I’ll disable them all. this will depend on your needs.<\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-pod.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-sca.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-sca.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-trustmanagement.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-trustmanagement.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-netdumper.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-netdumper.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vmware-vpostgres.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vmware-vpostgres.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-updatemgr.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-updatemgr.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-fileintegrity.conf<\/strong><\/em><\/p>\n
                                                  Another subjective one to send or not….For my test I’ll disable them<\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-fileintegrity.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-applmgmt-upgrade.conf<\/strong><\/em><\/p>\n
                                                  For my test I’ll disable these<\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-applmgmt-upgrade.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-content-library.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-content-library.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vpxd-svcs.conf<\/strong><\/em><\/p>\n
                                                  \u2714\ufe0f KEEP<\/strong><\/p>\n
                                                  \n
                                                  \n
                                                  \n
                                                  \/storage\/log\/vmware\/vpxd-svcs\/authz-event.log\r\n\/storage\/log\/vmware\/vpxd-svcs\/vpxd-svcs-access*.log\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
                                                  \u274c DISABLE<\/strong><\/p>\n
                                                  \n
                                                  \n
                                                  \n
                                                  \/storage\/log\/vmware\/vpxd-svcs\/vpxd-svcs.log\r\n\/storage\/log\/vmware\/vpxd-svcs\/startup-error.log\r\n\/storage\/log\/vmware\/vpxd-svcs\/vpxd-svcs-runtime.log.stdout\r\n\/storage\/log\/vmware\/vpxd-svcs\/vpxd-svcs-runtime.log.stderr\r\n\/storage\/log\/vmware\/vpxd-svcs\/perf.log<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vsphere-ui-imlegit.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vsphere-ui-imlegit.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-vdtc.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vdtc.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-cis-license.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-cis-license.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-perfcharts.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-perfcharts.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-applmgmt.conf<\/strong><\/em><\/p>\n
                                                  \u2705 KEEP<\/strong><\/p>\n
                                                  \n
                                                  \n
                                                  \n
                                                  \/storage\/log\/vmware\/applmgmt\/applmgmt.log\r\n\/storage\/log\/vmware\/applmgmt-audit\/applmgmt-audit.log\r\n\/storage\/log\/vmware\/applmgmt-audit\/applmgmt-br-audit.log\r\n\/opt\/vmware\/var\/log\/lighttpd\/access.log\r\n\/opt\/vmware\/var\/log\/lighttpd\/error.log\r\n\/storage\/log\/vmware\/applmgmt\/vami.log\r\n\/storage\/log\/vmware\/applmgmt\/backup.log\r\n\/storage\/log\/vmware\/applmgmt\/restore.log\r\n\/storage\/log\/vmware\/applmgmt\/pnid_change.log<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
                                                  \u274c DISABLE<\/strong><\/p>\n
                                                  \n
                                                  \n
                                                  \n
                                                  \/storage\/log\/vmware\/applmgmt\/dcui.log\r\n\/storage\/log\/vmware\/applmgmt\/detwist.log\r\n\/storage\/log\/vmware\/applmgmt\/firewall-reload.log\r\n\/storage\/log\/vmware\/applmgmt\/applmgmt_vmonsvc.std*\r\n\/storage\/log\/vmware\/applmgmt\/backupSchedulerCron.log\r\n\/storage\/log\/vmware\/applmgmt\/progress.log\r\n\/storage\/log\/vmware\/applmgmt\/statsmoitor-alarms.log\r\n\/storage\/log\/vmware\/applmgmt\/StatsMonitor-*.log\r\n\/storage\/log\/vmware\/applmgmt\/StatsMonitorStartup.log.std*\r\n\/storage\/log\/vmware\/applmgmt\/PatchRunner.log\r\n\/storage\/log\/vmware\/applmgmt\/update_microservice.log\r\n\/storage\/log\/vmware\/applmgmt\/vcdb_pre_patch.*\r\n\/storage\/log\/vmware\/dnsmasq.log\r\n\/storage\/log\/vmware\/procstate\r\n\/storage\/log\/vmware\/applmgmt\/size.log\r\n\/storage\/log\/vmware\/applmgmt\/reconciliation.log<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n
                                                  \/etc\/vmware-syslog\/vmware-services-lookupsvc.conf<\/strong><\/em><\/p>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-lookupsvc.conf<\/pre>\n
                                                  \/etc\/vmware-syslog\/vmware-services-rhttpproxy.conf<\/strong><\/em><\/p>\n
                                                  Keepin these.<\/p>\n
                                                  <\/span>TLDR<\/span><\/h2>\n
                                                  sed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-sps.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-analytics.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vcha.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vmon.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vstats.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-certmgmt.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-eam.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vapi.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-observability.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-cloudvm.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vlcm.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-pod.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-trustmanagement.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vmware-vpostgres.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-updatemgr.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-fileintegrity.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-applmgmt-upgrade.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-sca.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-content-library.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-vdtc.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-cis-license.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-perfcharts.conf\r\nsed -i 's\/^\/#\/' \/etc\/vmware-syslog\/vmware-services-lookupsvc.conf<\/pre>\n
                                                  Testing looking at logs for a VM I created one, checked the logs, yup there it is.. delete it.. uhh where is it (searched by VM name)<\/p>\n
                                                  <\/span>\ud83e\udde9 vCenter VM Creation vs. Deletion Log Behavior \u2014 Summary<\/span><\/h1>\n
                                                  <\/span>\u2705 VM Creation; Always logged clearly in vpxd.log<\/span><\/h2>\n
                                                  Always includes the VM name<\/p>\n
                                                  Easy to find by searching for the VM name<\/p>\n
                                                  Example:<\/p>\n
                                                  Code
                                                  \nCreateVM_Task: Creating VM ‘MyCustomVM’<\/p>\n
                                                  <\/span>\u274c VM Deletion; Deletion logs are not symmetrical with creation logs.<\/span><\/h2>\n
                                                  Key facts:
                                                  \nDeletion logs often do NOT include the VM name
                                                  \nInstead, they use the MoRef ID (e.g., vm-1234)
                                                  \nSearching by VM name will NOT find the deletion<\/p>\n
                                                  The deletion may appear as:
                                                  \nvim.ManagedEntity.destroy
                                                  \nDestroy_Task
                                                  \nUnregister
                                                  \nRemove from inventory<\/p>\n
                                                  Example:<\/p>\n
                                                  vim.ManagedEntity.destroy invoked for vm-1234<\/p>\n
                                                  No name. That\u2019s why you didn\u2019t see it.<\/p>\n
                                                  \u2b50 Why the name is missing<\/p>\n
                                                  When vCenter deletes a VM:
                                                  \nIt removes the VM object from inventory
                                                  \nThen logs the destroy event
                                                  \nThe name is already gone, so the log can\u2019t include it<\/p>\n
                                                  This is normal (and frustrating) vCenter behavior.<\/p>\n
                                                  \ud83d\udd0d How to reliably find deletion events<\/p>\n
                                                  Use the MoRef ID, not the VM name.
                                                  \nGet the MoRef from the creation log:<\/p>\n
                                                  grep -Ri “vm-1234” \/storage\/log\/vmware\/vpxd\/<\/p>\n
                                                  You\u2019ll see the deletion entry immediately.<\/p>\n
                                                  <\/span>Summary<\/span><\/h1>\n
                                                  What a royal PITA it is to manage sysloging on vCenter… :S<\/p>\n","protected":false},"excerpt":{"rendered":"
                                                  So, in my previous post I discussed troubleshooting the wd in wdpath already exists log error. However, the root issue there may have been determined and resolved… but the question arises… do we need to ship that much logs? What are all these log files for? High\u2011Level Overview Every file listed is part of vCenter … <\/p>\n
                                                  Continue reading “vCenter syslog\/rsyslog”<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"sfsi_plus_gutenberg_text_before_share":"","sfsi_plus_gutenberg_show_text_before_share":"","sfsi_plus_gutenberg_icon_type":"","sfsi_plus_gutenberg_icon_alignemt":"","sfsi_plus_gutenburg_max_per_row":"","footnotes":""},"categories":[5,8],"tags":[316,493,494],"class_list":["post-1779","post","type-post","status-publish","format-standard","hentry","category-hypervisors","category-server-administration","tag-logging","tag-rsyslog","tag-syslog"],"_links":{"self":[{"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/posts\/1779","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/comments?post=1779"}],"version-history":[{"count":10,"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/posts\/1779\/revisions"}],"predecessor-version":[{"id":1791,"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/posts\/1779\/revisions\/1791"}],"wp:attachment":[{"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/media?parent=1779"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/categories?post=1779"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zewwy.ca\/index.php\/wp-json\/wp\/v2\/tags?post=1779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}