This is not only a study, this could be a rapid guide to identify logs locations and their purposes.
Sources:
ESXi
Source:
- VMkernel
- Location: /var/log/vmkernel.log
- Purpose: ESXi and VM activities
- VMKernel warnings
- Location: /var/log/vmkwarning.log
- Purpose: VM activities
- VMkernel summary
- Location:/var/log/vmksummary.log
- Purpose: uptime and statistics about ESXi
- Host Agent
- Location: /var/log/hostd.log
- Purpose: info about agent that configure and manages ESXi host and VM
- vCenter Agent
- Location: /var/log/vpxa.log
- Purpose: info about agent that communicates with vCenter (only if host is managed by vCenter)
- Shell
- Location: /var/log/shell.log
- Purpose: commands typed into ESXi shell
- Authentication
- Location: /var/log/auth.log
- Purpose: authentication events
- System messages (aka syslog)
- Location: /var/log/syslog.log
- Purpose: messages that could be used for troubleshooting
vCenter
Sources:
- KB 1021804 https://kb.vmware.com/selfservice/search.do?cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=1021804
- Sean Whitney Blog http://www.virtually-limitless.com/vsphere-6-0/vcenter-server-6-0-log-locations/
In vSphere 6.x log files location directory are:
- Windows vCenter Server: %ALLUSERSPROFILE%\VMWare\vCenterServer\logs
- VCSA: /var/log/vmware/
- vpxd
- Location vCenter: vmware-vpx\vpxd.log
- Location VCSA: vpxd/vpxd.log
- Purpose: Main log file
- Profiler
- Location vCenter: vmware-vpx\vpxd-profiler.log
- Location VCSA: vpxd/vpxd-profiler.log
- Purpose: Profile metrics for operations in vCenter
- Alert
- Location vCenter: vmware-vpx\vpxd-alert.log
- Location VCSA: vpxd/vpxd-alert.log
- Purpose: Non-fatal info logged about vpxd process
- Stats
- Location vCenter: perfcharts\stats.log
- Location VCSA: perfcharts/stats.log
- Purpose: performance charts
- EAM
- Location vCenter: eam\eam.log
- Location VCSA: eam/eam.log
- Purpose: ESX agent manager
- Inventory service
- Location: inv-svc/inv-svc.log
- Purpose: log by inventory service
- Note: use inv-svc/wrapper.log for troubleshooting
- Dump Collector
- Location: netdump
- Purpose: Collect ESXi Dump file
- vapi
- Location: vapi
- Purpose: vAPI Endpont activities
- vmdir
- Location: vmdird
- Purpose: Directory service activities
- Infos in SSO LDAP: vmdird\vmdid-syslog.log
- vSphere Syslog collector
- Location vCenter: vmsyslogcollector
- Location VCSA: syslog
- Profile Drive Storage Services (SPS)
- Location vCenter: vmware-sps\sps.log
- Location VCSA: vmware-sps/sps.log
- Database vPostgres:
- Location: vpostgres
- Purpose: vFabric Postgres database service activities
- Web Client
- Location: vsphere-client
- Purpose: vSphere Web client activities
- Troubleshooting informations error in vsphere web client: vpshere-client/logs/vsphere_client_virgo.log
- can help to determine why web client doesn’t start or crash: vpshere-client/wrapper.log
- System and HW Health Manager
- Location: vws
- Workflow manager
- Location: workflow
- Single Sign On (SSO)
-
- Auth failures and problem on identity sources: sso/vmware-sts-idmd.log
- Installation errors during config of vmdir (useful if adding another PSC on the same SSO domain): vmafd/vdcpromo.log
- Infos in SSO LDAP: vmdird\vmdid-syslog.log
VM
Sources:
- KB 1007805 : https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1007805
ESXi hosts store virtual machine-specific logging in the same directory as the virtual machine’s configuration files. Default name is vmware.log.
Multiple files could be present in the same directory which are rotated with vmware-#.log pattern.
It is possible to list the location of all files issue this command directly in esxi:
vim-cmd vmsvc/getallvms
The path of vmx file is the same of vmware.log .
Cluster
Sources:
For troubleshooting HA there is only one file located vCenter Server : /var/log/fdm.log. To troubleshoot agent installation problem see /var/log/fdm-installer.log
Upgrade
Sources:
Microsoft windows installer logs are placed on:
- Standard action log: *-msi.log in %TMP% folder
- custom action logs: vminst.log in %TMP% folder
- vc-install.txt (a human readable report of installation or upgrade process)
Note to parse a *-mis.log there is a tool called wilogutil.exe
First boot script log is located in %ProgramData%\VMware\CIS\logs\firstboot\:
- firstbootStatus.json: JSON file contains the current status of the installation process.
- firstbootInfrastructure.log: This log file contain messages that identify when the firstboot scripts were initiated and whether they completed successfully.
- *_stdout.log: This log file is created to capture the standard output of each firstboot scripts.
- *_stderr.log: This log file is created to capture the standard error of each firstboot scripts.
vCenter converter
Sources:
For VMware vCenter Converter Standalone 5.x and 6.0 client logs in the converter are located in C:\ProgramData\VMware\VMware vCenter Converter Standalone\logs
Agent logs are located in:
- C:\ProgramData\VMware\VMware vCenter Converter Standalone Agent\logs
- %ALLUSERSPROFILE%\Application Data\VMware\VMware vCenter Converter Standalone Client\logs
For Linux system there are no client logs on source machine because they are stored on the server side.