This occurs is the scratch location is to RAM, rather than a datastore, usually if the ESX boots from flash media (as writing the logs would accelerate flash wear).
Obviously the correct fix is to point it to a datastore:
Syslog.global.logDir = [<datastore-name>] /scratch/log Syslog.global.logDirUnique = true
(The second is if multiple ESX’s are configured to write logs to same location)
However, there may be scenarios when this is not desirable. For example, if all your datastore storage is VSAN (which doesn’t support having the ESX hosting VSAN writing to its VSAN datastore), and you don’t care about the logs. You simply just need the message suppressed so as not to hide other errors.
Set:
Syslog.global.logHost = udp://127.0.0.1:514
(Or even to a valid syslog server if you have one)
