VMware /storage/log 100% due to imfile-state – easy resolution

Introduction

Are you encountering an issue where your /storage/log directory is filling up with imfile-state files, particularly in the /var/log/vmware/rsyslogd directory? This article will explore the causes of this problem and provide you with a step-by-step guide to resolving it. Let’s dive into the issue and its solution.

Understanding the Cause

The imfile-state:XXXX files cluttering your /var/log/vmware/rsyslogd directory are a result of how the rsyslog daemon tracks messages that have already been sent to the syslog server. Over time, these files accumulate, potentially causing your storage to fill up, and that’s when the trouble begins.

Resolving the Issue

To address this problem, follow the steps outlined below:

1. Stop Rsyslog

First, stop the rsyslog service to prevent it from generating more imfile-state files. Open your terminal and run the following commands:

systemctl stop syslog.socket rsyslog.service

Afterward, verify that the service has been successfully stopped by checking the running processes:

ps aux | grep rsyslogd

Additionally, ensure that the rsyslogd.pid file does not exist in the /var/run directory:

2. Create a Directory for the Cron Job

Navigate to your home directory:

cd ~

Now, create a directory specifically for your cron job:

mkdir syslogcron
cd syslogcron/

3. Create a Shell Script for Cleaning imfile-state Files

Inside the ‘syslogcron’ directory, you’ll create a shell script named cleanimf.sh. To do this, run the following command:

vi cleanimf.sh

In the text editor that opens, paste the following content:

#!/bin/bash
find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}

Save the file and apply executable permissions to it:

chmod 755 cleanimf.sh

4. Set Up a Cron Job

Navigate to the /etc/cron.d directory:

cd /etc/cron.d

Now, create a cron job file called cleanimf.cron:

vi cleanimf.cron

In the text editor, add the following line to run the cleanimf.sh script every hour:

0 * * * * root /root/syslogcron/cleanimf.sh 2>&1

Save the file and exit the text editor.

5. Restart Rsyslog

With the cron job in place, you can now restart the rsyslog daemon:

systemctl start syslog.socket rsyslog.service

NOTE: If you need to remove the existing imfile-state files before implementing the cron job, you can run the following command to delete them manually:

find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}

Conclusion

Managing the imfile-state files filling up your /var/log/vmware/rsyslogd directory is essential to maintain a clean and organized log storage system. By following the steps outlined in this guide, you can prevent this issue from recurring and ensure your system’s logs are properly managed.

🔥Subscribe to the channel: https://bit.ly/3vY16CT🔥

🚨Read my blog: https://angrysysops.com/

👊Twitter: https://twitter.com/AngrySysOps
👊Facebook: https://www.facebook.com/AngrySysOps
👊My Podcast: https://bit.ly/39fFnxm
👊Mastodon: https://techhub.social/@AngryAdmin