Move ESXi Syslog Global Directory
In this blog, we will show you how to move the ESXi syslog directory to an alternate shared datastore. If you have installed VMware’s ESXi OS on a USB storage drive or SD card, you may have seen the following warning: System logs are stored on non-persistent storage on ESX 7. X.
On the ESX host, by default core dumps and syslogs will be stored in the Scratch Location /tmp/scratch.
ESXi hosts which are booting from USB flash media do not have a permanent scratch location. Instead a path /tmp/Scratch will be mapped into their RAM disk. A reboot of the host results in all logs being lost and that could be an issue when it comes to troubleshooting. If the scratch partition is not reachable during an esx outage, the ESXi will function however tasks such as vMotion etc won’t work as required.
Unlike modifying the scratch partition, which will require the esx host to be placed in maintenance mode and rebooted post the location change – No reboots are required for modifying the Syslog Directory
In order to modify the Syslog directory ESXi server, Go to esx host > Configure > System > Advanced System Settings
Edit and Search for Syslog as shown. Syslog.global.LogDir defines the global log store which by default is pointed to /scratch/log
We will need to type the name of the datastore in brackets followed by a folder name.
If you want each host to use a distinct subfolder for logging, we can as well set
Syslog.global.logDirUnique to be true
To make it a bit more presentable, I will go ahead and create subfolders inside our .hostlogs as shown ie: esx08.
We will need to put Syslog. global.LogDir in the format [datastoreName]/logdir so for our case it will be [Local-VMFS-3 ].hostlogs/esx09
Click OK to finish the config and you will see the following folders being created
The link to the official VMware KB article for this warning is here: https://kb.vmware.com/s/article/2032823