knowledge base

Working with vCenter and ESXi Log Files
vCenter Server Log files
vCenter Server 5.x on Windows Server 2003: %ALLUSERSPROFILE%\Application Data\VMware\VMware VirtualCenter\Logs\ vCenter Server 5.x on Windows Server 2008: %ALLUSERSPROFILE%\VMware\VMware VirtualCenter\Logs\ vCenter Server 5.x Linux Virtual Appliance: /var/log/vmware/vpx/
With a Windows Server implementation of vCenter, browse to the log file location and edit the logfile in a text editor.
/var/log/auth.log: ESXi Shell authentication success and failure attempts. /var/log/dhclient.log: DHCP client log. /var/log/esxupdate.log: ESXi patch and update installation logs. /var/log/hostd.log: Host management service logs, including virtual machine and host Task and Events, communication                           with the vSphere Client and vCenter Server vpxa agent, and SDK connections. /var/log/shell.log: ESXi Shell usage logs, including enable/disable and every command entered. /var/log/boot.gz: A compressed file that contains boot log information and can be read using zcat /var/log/boot.gz|more. /var/log/syslog.log: Management service initialization, watchdogs, scheduled tasks and DCUI use. /var/log/usb.log: USB device arbitration events, such as discovery and pass-through to virtual machines. /var/log/vob.log: VMkernel Observation events, similar to vob.component.event. /var/log/vmkernel.log: Core VMkernel logs, including device discovery, storage and networking device and driver events,                               and virtual machine startup. /var/log/vmkwarning.log: A summary of Warning and Alert log messages excerpted from the VMkernel logs. /var/log/vmksummary.log: A summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of                                 virtual machines running, and service resource consumption.
The way to View vSphere Log Files There are a number of ways in which you can view log files, depending on whether they are for vCenter or for an ESXi host. I'll start by looking at ways in which you can view host log files. The first place is simply from the DCUI on the host. You can move down to 'View System Logs', then choose the log file that you would like to view: The second way is to use the vSphere client. By making a connection directly to a host, rather than vSphere, you can view the hosts log files: If you are connected to vCenter rather than a host, you can browse to the same place, but instead of host logs, you can view the vCenter logs files. Another way to view a host's log files is to use a web browser. This is a method I always forget is available, but it definitely has its uses. Using the url:
After you have authenticated with the vCenter web page you can access to the host log files. My preferred way, when possible, is to SSH to the host and view the log files from the SSH console.
cat hostd.log | more less hostd.log tail hostd.log tail -f hostd.log zcat /var/log/boot.gz
Search a keyword, such as "error" in the logfile hostd.log using grep:
cat hostd.log | grep keyword
The last method of viewing host log files that I want to mention is by using PowerCLI. Having established a connection to my vCenter server, running Get-LogType displays the vCenter logs that are available to view: We can use the Get-Log cmdlet to view the log files:
(Get-Log -VMHost (Get-VMHost IP-ADDRESS) vmkernel).Entries
This will show everything in the vmkernel log, however if we are looking for something in particular we can filter the log using something like:
(Get-Log -VMHost (Get-VMHost IP-ADDRESS) vmkernel).Entries | Where {$_ -like "*cpu*"}