VMware ESXi 4 Log Files

Source : /www.simonlong.co.uk/blog/

Like most VI Admins, I've been using VMware ESXi quite a lot more lately and I'm slowly coming across things that are different to how they are in ESX. Log files being one of these differences.
With the absence of the Service Console, ESXi presents a slightly different architecture. If you haven't yet read The Architecture of VMware ESXi, I would recommend having a good read through.
Here is the common log file structure in ESX (Source)

 Click below --> "Read More" for Full Article (Log File Geometry & Snippets)..

• /var/log/vmware/hostd.log – ESX Service Log
• var/log/vmware/vpx/vpxa.log – vSphere Client Agent Logs
• /var/log/vmware/aam – VMware HA Logs
• /var/logvmkernel – VMKernel Messages
• /var/log/vmkwarning – VMKernel Warnings
• /var/log/messages – Service Console Log

Here is the common log file structure in ESXi

• /var/log/vmware/hostd.log – ESXi Service Log
• var/log/vmware/vpx/vpxa.log – vCenter Agent Logs
• /var/log/messages – Syslog Log (Combines vmkernel & hostd)

As you can see there are a few less logs within ESXi. The message log contains both vmkernel logs and hostd logs. It might also contain the vmkwarning logs, but whilst looking through my log files I was unable to proove this. One log I couldn't find was the AAM log, so if anyone knows what has happened to this log please get in contact.

When to use these log files

• hostd.log – This is the ESXi Host Agent log. It contains information on the agent that manages the ESXi Host and it's VM's. I don't tend to use this log as much as I used to with ESX, purely because it has been amalgamated in the message log. If you are troubleshooting a Host issue and don't want vmkernel logs getting in the way, this is the log for you. The log entries are time stamped which is pretty handy when looking back to see what happened when an error occurred or something failed.
• vpxa.log – This log contains information from the agent which communicates with vCenter. This log will not exist if your Host is standalone. I often use this log if I am having HA issues (See previous post). You can also find other information here, such as your Primary HA Cluster Nodes. These log entries are also time stamped.

• messages.log – Contains messages from both vmkernel and hosts, used for troubleshooting the ESXi Host of VM's. Messages from either Hostd or vmkernel are denoted after the time stamp as shown in the image below.

Viewing log files in ESXi 4
With the lack of COS we are now unable to view the logs via SSH and be supported by VMware. So what other options do we have?

• Using the ESXi Console
• Using a Web Browser
• Using a Syslog Server
• Exporting System Logs in vCenter
• Using PowerCLI

Plenty of options, I'll take you through them.

Using the ESXi Console
Using the ESXi Console (Yellow/Grey) you can login and view the Messages, Hostd and vpxa logs. Although, if I'm honest it's sometimes a little difficult to read them. The ESXi Console can be accessed either locally on the Host or via remote console access systems like ILO and DRAC.



Using a Web Browser
I found this on techhead.co.uk but I will include the steps here to keep everything in one please.

• Open your favorite Web Browser
• Enter the following: https:///host
• Enter the ESXi Host Root username/password

Exporting System Logs in vCenter
You can Export your system logs whilst connect to vCenter using your VIC. The steps to do this can be found here: Export Diagnostic Data If your downloading to a Windows Workstation you can use Winrar to decrompress the log files

Sources
http://communities.vmware.com/docs/DOC-11511
http://www.vmware.com/files/pdf/vmware_esxi_architecture_wp.pdf
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1016621