Symptoms

Excessive Log Ingestion The system shows a large volume of vsantraceurgent logs being ingested into Aria Operations for Logs.

Cause

Enabled Log Urgent Traces To Syslog By default, vSAN trace logs are stored locally on each ESXi host. When the Log Urgent Traces To Syslog setting is enabled, urgent trace messages are forwarded to the configured syslog target (Aria Operations for Logs). Frequent internal vSAN events or high cluster load increase the number of these urgent traces, resulting in excessive log volume. For more details, see Redirecting urgent vSAN trace-level messages to a syslog server.

Resolution

Stop or Reduce Log Forwarding Verify Current Configuration Connect to the ESXi host via SSH and run the following command to check if syslog forwarding is enabled: esxcli vsan trace get Look for the line Log Urgent Traces To Syslog: true. Disable Forwarding to Syslog Run the command below to stop the excessive ingestion into Aria Operations for Logs: esxcli vsan trace set --logtosyslog false This change takes effect immediately and does not require a service restart. (Optional) Tune Local Retention If you also want to limit the number and size of urgent trace files stored locally, adjust the settings based on the ESXi version: For ESXi 8.x: esxcli vsan trace set --urgentnumfiles=4 --urgentsize=8 --numfiles=10 --size=8 For ESXi 7.x: esxcli vsan trace set --urgentnumfiles=10 --urgentsize=10 --numfiles=10 --size=10 Error "The ramdisk 'vsantraces' is full"

Support Cases