Symptoms
/storage/log is filling up and there are many files in the /var/log/vmware/rsyslogd directory. You may or may not be able to list the contents of /var/log/vmware/rsyslogd/.
Cause
The imfile-state:XXXX files are created due to the rsyslog daemon's method of tracking messages that have already been sent to the syslog server.
Resolution
To resolve this issue, create a cron job to clear these files.
Stop rsyslog
systemctl stop syslog.socket rsyslog.service
Verify that the service is stopped
ps aux | grep rsyslogd
Verify in /var/run that rsyslogd.pid does not existCreate a directory for the cron job
cd ~mkdir syslogcroncd syslogcron/
Create a file called cleanimf.sh and save it with contents below.
vi cleanimf.sh#!/bin/bashfind /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}
After saving the file (by typing ':wq'), apply permissions to the file
chmod 755 cleanimf.sh
Create a cron job to execute the script every hour (remember to save the file with ':wq')
cd /etc/cron.dvi cleanimf.cron0 * * * * root /root/syslogcron/cleanimf.sh 2>&1
Start the rsyslog daemon
systemctl start syslog.socket rsyslog.service
Related Information
To remove all the files immediately (before creating the cron job), run the following command and wait until it finishes:
find /var/log/vmware/rsyslogd/ -name "imfile-state*" | xargs -i rm -f {}
