This is how I have configured the vCenter Appliance to rotate the syslogs from my ESXi hosts. I'm not sure if these changes are supported by VMware, or if they survive an upgrade, so buyer beware.
- Backup the syslog-collector.conf configuration file.
cp /etc/syslog-ng/syslog-collector.conf /etc/syslog-ng/syslog-collector.conf.orig
- Edit syslog-collector.conf and change the file format:
file("/var/log/remote/$HOST_FROM/messages" - Reload syslog-collector service.
/etc/init.d/syslog-collector reload
If you use the same file format as I have then you should now have a messages file for each host under /var/log/remote/hostname. I use the following config file to rotate the logs daily:
/etc/logrotate.d/syslog-remote
/var/log/remote/*/messages { daily compress delaycompress rotate 14 postrotate /etc/init.d/syslog-collector reload > /dev/null endscript
}