Wednesday 19 February 2014

verifying reload of syslog server

This post is gonna be a bit messy.  I'm trying (again) to start learning about PowerCLI so there are more things that I don't know than things that I do.  No worries, post comments and help me as all I know is Bourne Shell scripting.  (^;

I'm checking my syslog settigns are all consistent and correct.  Of course we can check and change them from vCenter (or new vCenter web client--shudder!), but more than a few hosts are best done by scripts/cli.

I can check this from PowerVCLI:

get-vmhost | Get-VMHostAdvancedConfiguration -Name Syslog.global.logHost

or specific hosts:

Get-VMHostAdvancedConfiguration -Name Syslog.global.logHost -VMHost host1


Name                           Value
----                           -----
Syslog.global.logHost          udp://1.2.3.4:514

and I can even fix it with a script using these commands

Set-VMHostAdvancedConfiguration -Name Syslog.global.logHost -Value 'udp://1.1.1.1:514' -VMHost host1

$esxcli = Get-EsxCli -VMHost host1
    $esxcli.system.syslog.reload()

thanks to this cool script kindly provided by Caleb here.

So, the reloading of the syslog service.  This isn't the usual linux service there's a command for reloading:
from the ESXi host (ssh/putty/DUI session):

~ # esxcli system syslog reload

the VMware kbase article(s) say to check the syslog is running with the good ol' linux ps command:

~ # ps | grep vmsyslogd
8666 8666 vmsyslogd            /bin/python
8667 8666 vmsyslogd            /bin/python
8668 8666 vmsyslogd            /bin/python

But how do you verify whether either of these methods have worked (other than the absence of error messages?).  

Seems /var/log/hostd.log is where this is recorded:

reload issued via PowerCLI:
2014-02-19T11:39:14.045Z [32B81B90 info 'Solo.VmwareCLI'] Dispatch reload
2014-02-19T11:39:14.114Z [32B81B90 info 'Solo.VmwareCLI'] Dispatch reload done

reload issued directly from ESXi linux login session:
2014-02-19T11:52:30.677Z [2A9DEB90 verbose 'Hostsvc.SyslogConfigProvider'] Running '/sbin/localcli system syslog config logger list'
2014-02-19T11:52:30.678Z [2A9DEB90 info 'SysCommandPosix'] ForkExec(/sbin/localcli)  393025
2014-02-19T11:52:30.830Z [2A9DEB90 verbose 'Hostsvc'] Received advanced config change notification


Can you shed any light on this?

Join the discussion and add your perspective.   Thanks, KC