VMware Log Locations & Descriptions

The vCenter Server logs can be viewed from:

• The vSphere Client connected to vCenter Server (click Home > Administration > System Logs)
• The vSphere Client connected to VirtualCenter Server (click Administration > System Logs).

The logs are located in %ALLUSERSPROFILE%\Application Data\VMware\VMware VirtualCenter\Logs, which translates to C:\Documents and Settings\All Users\Application Data\VMware\VirtualCenter\logs in Windows 2003 and C:\ProgramData\VMware\VMware VirtualCenter\Logs in Windows 2008.

 

The vCenter Server logs appear as vpxd-xx.log.

 

The vpxd-profiler-xx.log is used for the VPX Operational Dashboard (VOD),which can be accessed via https:///vod/index.html.

• Vmkernel – /var/log/vmkernel – records activities related to the virtual machines and ESX server.


• Vmkernel Warnings – /var/log/vmkwarning – This log is a copy of everything marked as a warning or higher severity from vmkernel log. It is much easier to look through this for warnings and errors, instead of filtering through the full information in the vmkernel logs.

• Vmkernel Summary – /var/log/vmksummary – Used to determine uptime and availability statistics for ESX Server; human-readable summary found in /var/log/vmksummary.txt

• ESX Server host agent log – /var/log/vmware/hostd.log – Contains information on the agent that manages and configures the ESX Server host and its virtual machines (Search the file date/time stamps to find the log file it is currently outputting to).

• Service Console – /var/log/messages – This log is the log from the Linux kernel (service console), which is generally only potentially useful in the case of a host hang, crash, authentication issue, or 3rd party app acting up. This log has NOTHING to do with virtual machines. The SERVICE CONSOLE (red hat kernel) has NO awareness of the VMs (worlds) running on the VMKERNEL.

Location of Logs & Brief note on that

• Web Access – /var/log/vmware/webAccess – Records information on Web-based access to ESX Server.

• Authentication log – /var/log/secure – Contains records of connections that require authentication, such as VMware daemons and actions initiated by the xinetd daemon.

• VirtualCenter agent – /var/log/vmware/vpx – Contains information on the agent that communicates with VirtualCenter.

• Virtual Machines – The same directory as the affected virtual machine’s configuration files; named vmware.log – Contain information when a virtual machine crashes or ends abnormally.

/var/log/vmkernel Vmkernel Records activities related to the virtual machines and ESX host

/var/log/vmkwarning Vmkernel Warnings A copy of everything marked as a warning or higher severity from vmkernel log. Easier to look through than vmkernel log

/var/log/vmksummary Vmkernel Summary Used for avaialability and uptime statistics. Human-readable summary in vmksummary.txt

/var/log/vmware/hostd.log Host Agent Log Contains information on the agent that manages and configures the ESX host and its virtual machines

/var/log/vmware/vpx VirtualCenter Agent Contains information on the agent that communicates with VirtualCenter

/var/log/messages Service Console Log from the Linux kernel. Useful for underlying Linux issues. The kernel has no awareness of VMs running on the VMkernel

/var/log/vmware/esxcfg-boot.log ESX Boot Log ESX Boot log, logs all ESX boot events

/var/log/vmware/webAccess Web Access Records information on Web-based access to ESX Server

/var/log/secure Authentication Log Contains records of connections that require authentication, such as VMware daemons and actions initiated by the xinetd daemon

/var/log/vmware/esxcfg-firewall.log ESX Firewall Log Contains all firewall rule events

/var/log/vmware/aam High Availability Log Contains information related to the High Availability (HA) service

/var/log/vmware/esxupdate.log ESX Update Log Logs all updates completed using the esxupdate tool

There’s a new Knowledgebase article on this here: VMware KB: http://kb.vmware.com/kb/1021806 Location of log files for VMware products