VMware ESXi 4 vs ESXi 5 Log File Locations

This post is inspired by a tweet from Andrew Storrs, where he pinpoints that the host log file locations have changed between ESXi 4 and ESXi 5.

Note: This post has been updated with new log files for ESXi 5.1

ESXi 4 Log File Locations:

Log file locationLog file description
/var/log/messagesCore VMkernel logs, including device discovery, storage and networking device and driver events, virtual machine startup, and a merged copy of the hostd and vpxa management service logs.
/var/log/vmware/hostd.logHost management service logs, including virtual machine and host Tasks and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
/var/log/sysboot.logEarly VMkernel startup, module loading, and host initialization.

ESXi 5 Log File Locations:

Log file locationLog file description
/var/log/auth.logESXi Shell authentication success and failure.
/var/log/dhclient.logDHCP client service, including discovery, address lease requests and renewals.
/var/log/esxupdate.logESXi patch and update installation logs.
/var/log/hostd.logHost management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
/var/log/shell.logESXi Shell usage logs, including enable/disable and every command entered.
/var/log/sysboot.logEarly VMkernel startup and module loading.
/var/log/syslog.logManagement service initialization, watchdogs, scheduled tasks and DCUI use.
/var/log/usb.logUSB device arbitration events, such as discovery and pass-through to virtual machines.
/var/log/vob.logVMkernel Observation events, similar to vob.component.event.
/var/log/vmkernel.logCore VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.
/var/log/vmkwarning.logA summary of Warning and Alert log messages excerpted from the VMkernel logs.
/var/log/vmksummary.logA summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption.

Between version 5.0 and 5.1 the log file locations have not changed, but a couple of new logs have been added.

ESXi 5.1 New Log File Locations:

Log file locationLog file description
/var/log/lacp.logLink Aggregation Control Protocol logs
/var/log/hostd-probe.logHost management service responsiveness checker
/var/log/rhttpproxy.logHTTP connections proxied on behalf of other ESXi host webservices.

Clearly the number of host log file has increased in newer versions, and that should make it much easier to find the log entries you are looking for. A more granular logging into different specialized log files can only be a good thing.

Logs from vCenter Server Components on ESXi 5.1:

Log file locationLog file description
/var/log/vpxa.logvCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent
/var/log/fdm.logvSphere High Availability logs, produced by the fdm service

Just remember that ESXi only logs to memory, and that you need to set logging to a syslog server to preserve logs between reboots. If ESXi 5 is installed on local disk, the log files will be persistent through reboots, since it creates a zipped archive in /var/run/log. If ESXi is deployed via Auto Deploy, no local disk is used and the log files are not persistent, and needs to be collected by an external syslog service.

For more details about various VMware products and their log file locations, check VMware Knowledgebase article 1021806 and VMware Knowledgebase article 2032076

9 thoughts on “VMware ESXi 4 vs ESXi 5 Log File Locations

  1. FYI… if you install ESXi 5.0 on a local disk, it will create a 4 GB partition that will be used as “Scratch” space. The logs are routed to that local FAT partition. In ESXi 4.x it was /scratch/ in ESXi 5.0 the history files are zipped in /var/run/log. Cheers!

  2. Nice work Christian.

    Also maybe worth mentioning that when deploying hosts with Auto Deploy the host logs are obviously stored in memory. You may want to configure a network based logging such as syslog collector to retain logs over a reboot.

    1. We have ESXi 5.1 environment and I have configured Syslog Collector on the VCenter server and I can see the syslog.log created under the Host IP – subfolder.

      But my query is about the other logs other than syslog.log..? For ex: fdm.log, vmkernel.log etc. Will they not be forwarded to Syslog collector Server..? Do I need to make any extra configuration to get these forwarded..?

      Please can I get some help..?

      Thanks

      Ashok

      1. If you take a deeper look at the syslog.log file you will see that this is indeed a combined log of the separate log files on an ESXi server. No additional configuration is required, unless you want to edit the log levels to add or remove chatter from the log files.

Leave a Reply