vCenter Server Log files
- vCenter Server 5.x on Windows Server 2003: %ALLUSERSPROFILE%\Application Data\VMware\VMware VirtualCenter\Logs\
- vCenter Server 5.x on Windows Server 2008: %ALLUSERSPROFILE%\VMware\VMware VirtualCenter\Logs\
- vCenter Server 5.x Linux Virtual Appliance: /var/log/vmware/vpx/
With a Windows Server implementation of vCenter, browse to the log file location and open the log in your favorite text editor.
ESXi Log Files
- /var/log/auth.log: ESXi Shell authentication success and failure attempts.
- /var/log/dhclient.log: DHCP client log.
- /var/log/esxupdate.log: ESXi patch and update installation logs.
- /var/log/hostd.log: Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
- /var/log/shell.log: ESXi Shell usage logs, including enable/disable and every command entered.
- /var/log/boot.gz: A compressed file that contains boot log information and can be read using zcat /var/log/boot.gz|more.
- /var/log/syslog.log: Management service initialization, watchdogs, scheduled tasks and DCUI use.
- /var/log/usb.log: USB device arbitration events, such as discovery and pass-through to virtual machines.
- /var/log/vob.log: VMkernel Observation events, similar to vob.component.event.
- /var/log/vmkernel.log: Core VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.
- /var/log/vmkwarning.log: A summary of Warning and Alert log messages excerpted from the VMkernel logs.
- /var/log/vmksummary.log: A summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption.
Ways to View vSphere Log Files
There are a number of ways in which you can view log files, depending on whether they are for vCenter or for an ESXi host. I’ll start by looking at ways in which you can view host log files. The first place is simply from the DCUI on the host. You can move down to ‘View System Logs’, then choose the log file that you would like to view:
The second way is to use the vSphere client. By making a connection directly to a host, rather than vSphere, you can view the hosts log files:
If you are connected to vCenter rather than a host, you can browse to the same place, but instead of host logs, you can view the vCenter logs files.
Another way to view a host’s log files is to use a web browser. This is a method I always forget is available, but it definitely has its uses. Using a url like this one: https://192.168.0.235/host, will (after you have authenticated) present you with a web page from which you can access host log files:
My preferred way, when possible, is to SSH to the host and view the log files from the SSH console. Once connected you can view logs in a variety of ways such as:
- cat hostd.log | more
- less hostd.log
- tail hostd.log
- tail -f hostd.log
- zcat /var/log/boot.gz
You can also search logs using grep:
- cat hostd.log | grep keyword
The last method of viewing host log files that I want to mention is by using PowerCLI. Having established a connection to my vCenter server, running Get-LogType displays the vCenter logs that are available to view:
By running this against a host, rather than vcenter, we see the following:
We can use the Get-Log cmdlet to view the log files:
(Get-Log -VMHost (Get-VMHost 192.168.0.235) vmkernel).Entries
This will show everything in the vmkernel log, however if we are looking for something in particular we can filter the log using something like:
(Get-Log -VMHost (Get-VMHost 192.168.0.235) vmkernel).Entries | Where {$_ -like “*cpu*“}