Which logs on ESXi from /var/logs are sent to Splunk? Is there an easy way to get an estimated daily size before configuring the host to send logs to Splunk?
This is answered in the Splunk documentation for the Splunk Add-on for VMware.
The input stanza for ESXi logs is
[monitor:///var/log/.../syslog.log]
Collected data type Data volume
Total vCenter logs 15 MB of data per host per day per vCenter
ESXi host logs ~185 MB of data per host per day
Total API data per host 10 MB of data per host per day.
Total API data per virtual machine 3 MB of data per day.
This is answered in the Splunk documentation for the Splunk Add-on for VMware.
The input stanza for ESXi logs is
[monitor:///var/log/.../syslog.log]
Collected data type Data volume
Total vCenter logs 15 MB of data per host per day per vCenter
ESXi host logs ~185 MB of data per host per day
Total API data per host 10 MB of data per host per day.
Total API data per virtual machine 3 MB of data per day.
Perfect. Thanks! I guess RTFM 🙂