Information
ESXi can be configured to store log files on an in-memory file system. This occurs when the host's Syslog.global.LogDir property is set to a non-persistent location, such as /scratch. When this is done, only a single day's worth of logs are stored at any time. Additionally, log files will be reinitialized upon each reboot.
Rationale:
Non-persistent logging presents a security risk because user activity logged on the host is only stored temporarily and will not be preserved across reboots. This can also complicate auditing and make it harder to monitor events and diagnose issues. ESXi host logging should always be configured to a persistent datastore.
Solution
To configure persistent logging properly, perform the following from the vSphere web client:
Select the host and go to 'Configure' -> 'System' -> 'Advanced System Settings'.
Enter Syslog.global.LogDir in the filter.
Set the Syslog.global.LogDir to a persistent location specified as [datastorename] path_to_file where the path is relative to the datastore. For example, [datastore1] /systemlogs.
Make sure the attribute is highlighted, then click the pencil icon.
Alternatively, run the following PowerCLI command:
# Set Syslog.global.logDir for each host
Get-VMHost | Foreach { Set-AdvancedConfiguration -VMHost $_ -Name Syslog.global.logDir -Value '<NewLocation>' }
References:
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-9F67DB52-F469-451F-B6C8-DAE8D95976E7.html
http://kb.vmware.com/kb/1033696
Notes:
Note: Syslog.global.LogDir must be set for each host. The host syslog parameters can also be configured using the vCLI or PowerCLI, or using an API client.