VMware ESXi 4 vs ESXi 5 Log File Locations

This post is inspired by a tweet from Andrew Storrs, where he pinpoints that the host log file locations have changed between ESXi 4 and ESXi 5.

Note: This post has been updated with new log files for ESXi 5.1

ESXi 4 Log File Locations:

Log file locationLog file description
/var/log/messagesCore VMkernel logs, including device discovery, storage and networking device and driver events, virtual machine startup, and a merged copy of the hostd and vpxa management service logs.
/var/log/vmware/hostd.logHost management service logs, including virtual machine and host Tasks and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
/var/log/sysboot.logEarly VMkernel startup, module loading, and host initialization.

ESXi 5 Log File Locations:

Log file locationLog file description
/var/log/auth.logESXi Shell authentication success and failure.
/var/log/dhclient.logDHCP client service, including discovery, address lease requests and renewals.
/var/log/esxupdate.logESXi patch and update installation logs.
/var/log/hostd.logHost management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
/var/log/shell.logESXi Shell usage logs, including enable/disable and every command entered.
/var/log/sysboot.logEarly VMkernel startup and module loading.
/var/log/syslog.logManagement service initialization, watchdogs, scheduled tasks and DCUI use.
/var/log/usb.logUSB device arbitration events, such as discovery and pass-through to virtual machines.
/var/log/vob.logVMkernel Observation events, similar to vob.component.event.
/var/log/vmkernel.logCore VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.
/var/log/vmkwarning.logA summary of Warning and Alert log messages excerpted from the VMkernel logs.
/var/log/vmksummary.logA summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption.

Between version 5.0 and 5.1 the log file locations have not changed, but a couple of new logs have been added.

ESXi 5.1 New Log File Locations:

Log file locationLog file description
/var/log/lacp.logLink Aggregation Control Protocol logs
/var/log/hostd-probe.logHost management service responsiveness checker
/var/log/rhttpproxy.logHTTP connections proxied on behalf of other ESXi host webservices.

Clearly the number of host log file has increased in newer versions, and that should make it much easier to find the log entries you are looking for. A more granular logging into different specialized log files can only be a good thing.

Logs from vCenter Server Components on ESXi 5.1:

Log file locationLog file description
/var/log/vpxa.logvCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent
/var/log/fdm.logvSphere High Availability logs, produced by the fdm service

Just remember that ESXi only logs to memory, and that you need to set logging to a syslog server to preserve logs between reboots. If ESXi 5 is installed on local disk, the log files will be persistent through reboots, since it creates a zipped archive in /var/run/log. If ESXi is deployed via Auto Deploy, no local disk is used and the log files are not persistent, and needs to be collected by an external syslog service.

For more details about various VMware products and their log file locations, check VMware Knowledgebase article 1021806 and VMware Knowledgebase article 2032076

Verifying VMware Downloads

Now that vSphere 5.1 and assorted products have been released into the wild, how do you check the integrity of your downloaded file? As you might be aware of, VMware publishes both MD5 and SHA1 hashes for their files, making it possible to check if the file you just downloaded is identical to the file offered from VMware.

Checking the MD5 or SHA1 hash for a single file is easy, at least in OS X where you don´t need any third party tools to check.

Open up Terminal and navigate to your download directory and run either the md5 command, or the shasum command to verify the file signature. You can then compare the signature to the checksums provided by VMware on the download page.


For a single file, this is not a problem, but what if you have downloaded a bunch of files into a directory and want to calculate the checksums for all of them in one go?

Thankfully this is pretty simple as well, just add a little Terminal (It´s really bash, I know) magic and you´re all set:

[cci lang=”bash”]find . -type f -exec md5 ‘{}’ \;[/cci]

[cci lang=”bash”]find . -type f -exec shasum ‘{}’ \;[/cci]

These small bash one-liners will go through all the files in the current directory, and calculate checksums for each of them.

There are tools available for Windows as well that perform the same operations, but I haven´t looked into those for this post.

A collection of MD5/SHA1 checksums for the vSphere 5.1 Release:



As far as I can tell, VMware does not offer a single page that lists all of the checksums for their files, something that makes finding the checksums a bit tedious. I´ve found that the best way to find then, after you have downloaded the files, is to check the My VMware Downloads History, page since it shows you all the downloads you have performed on one page, instead of going through multiple pages. Find the “Show Checksums” link to show the checksums, without having to open the download page for each item.



I´m sure some scripting Wizkid could easily create a script that runs the checksum generation and then checks a given text file for a match, but I really wish VMware would create a service that enables you to easily check the checksums for a given file, without having to log on to VMware.com at all.

If we could do a simple HTML request to a service that returns the checksum for a given file, that would easily be scriptable and comparisons could be performed automatically.

That way, doing a request like this (yes, this is indeed a fake non-working URL):
[cci lang=”bash”]curl vmware.com/integrity/md5/vCO_VA-[/cci]

would return a simple


Good idea? Bad Idea? Let me know!

… and All I Asked for Was a Pin

Way back in the old days, you know when VMworld 2012 was held in San Francisco, I tweeted that if someone could get hold of a VCP pin for me, I would be very happy.

Luckily Paul Valentino from vCommunity Trust picked that up, and apparently went on quite the scavenger hunt on my behalf.

Imagine my surprise today when this little square meter of carton appeared, courtesy of Mr. Valentino:

For some reason I suspected that Paul had not only shipped me a VCP pin and that there might be a couple of other things in the package as well.

Indeed, a VMworld 2012 Backpack filled with various items, like the VMware vSphere 5.1 Clustering Deepdive book, the NetApp Data ONTAP Edge VSA, and a VMware Workstation 9 license key amongst other things (stickers, pins and a t-shirt).

Thanks a lot Paul, your VMworld Marshall Plan is very, very much appreciated!