ESXi hosts which are booting from SAN or USB flash media do not have a permanent scratch location. Instead a path /tmp/Scratch will be mapped into their RAMdisk. That has a big disadvantage, because after a reboot all logs are lost. Especially for troubleshooting this is a real problem.
Syslog
First we need to separate two things: Scratch and Syslog. By default core dumps and syslogs will be stored in the scratch location.
You can redirect log data in two ways. A global logstore on persistent storage, or a syslog-server.
Global logstore
Go to advanced host settings (Host > System > Advanced System Settings) and select “Edit”. Filter your search for LogDir.
Syslog.global.LogDir defines the global logstore.
Enter target like [Datastore01]logstore. You have to type the datastore name in brackets followed by the folder name (logstore).
If you want each host to use a distinct subfolder for logging, you should set
Syslog.global.logDirUnique to true in vSphere-Client or tick the checkbox in Web-Client.
Syslog Server
An alternative to a global logstore you can push logs to a syslog server. Default is a UDP connection on port 514. Enter target host at advanced system settings
Syslog.global.LogHost.
udp://mysylogsrv.mydomain.local:514
As an alternative to UDP you can also use TCP or SSL.
tcp://mysylogsrv.mydomain.local:514
ssl://mysylogsrv.mydomain.local:514
Scratch
Redirecting syslog data does not affect the location of core dumps. ESXi will put them to scratch (which is mapped to RAM disk). So it’s a good idea to also redirect scratch to a persistent store. A good location would be an NFS store that you can access without an ESXi host. But if you don’t have an NFS store at hand, you can also use a VMFS datastore. As long as not all of your hosts crash at the same time that should be fine.
Create folder
There are multiple ways to create a scratch folder. Either you create one in the vSphere-Client (Datastore View), or by mkdir command on a SSH-shell.
Important! Every host needs a directory on its own.
In the following example I will create a folder [Scratch] on my first VMFS volume [Datastore01]. Below Sctatch I will create folders for each of my ESXi hosts. Name them like your hosts and use a leading dot [.] in order to hide them in listings.
cd /vmfs/volumes/Datastore01
mkdir Scratch
cd Scratch
mkdir .locker-esx1.mydomain.local
mkdir .locker-esx2.mydomain.local
Now the folders are created we can configure our hosts to use them. Select the first host and go to advanced system settings. Klick “Edit” and filter for “scratch”. You will se two entrys:
- ScratchConfig.ConfiguredScratchLocation
- ScratchConfig.CurrentScratchLocation
If your scratch is located in RAM disk there will be no value at
ConfiguredScratchLocation. There will be /tmp/scratch next to
CurrentScratchLocation.
You need to enter the entire path to the scratch location you’ve created before at ScratchConfig.ConfiguredScratchLocation.
Example: /vmfs/volumes/Datastore01/Scratch/.locker-esx1.mydomain.local
Alternativly you can use the UID: /vmfs/volumes/5c195cad-2a78dea0-b69a-0019999ca679/Scratch/.locker-esx1.mydomain.local
To activate these settings you need to reboot the host. But there’s a catch! If you wait more than 12 hours between editing the values and reboot, your edits may become void. After a reboot you can check the value at
ScratchConfig.CurrentScratchLocation.