| From the vSphere Client, go to Hosts and Clusters. |
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Select the "Syslog.global.logDir" value and verify it is set to a persistent location.
If the value of the setting is " /scratch/logs", verify the advanced setting "ScratchConfig.CurrentScratchLocation" is not set to "/tmp/scratch". This is a nonpersistent location.
If "Syslog.global.logDir" is not configured to a persistent location, this is a finding.
From a PowerCLI command prompt while connected to the ESXi host, run the following commands:
$esxcli = Get-EsxCli -v2
$esxcli.system.syslog.config.get.Invoke() | Select LocalLogOutput,LocalLogOutputIsPersistent
If the "LocalLogOutputIsPersistent" value is not true, this is a finding.