VMware ESXi 4 vs ESXi 5 Log File Locations

This post is inspired by a tweet from Andrew Storrs, where he pinpoints that the host log file locations have changed between ESXi 4 and ESXi 5.

Note: This post has been updated with new log files for ESXi 5.1

ESXi 4 Log File Locations:

Log file locationLog file description
/var/log/messagesCore VMkernel logs, including device discovery, storage and networking device and driver events, virtual machine startup, and a merged copy of the hostd and vpxa management service logs.
/var/log/vmware/hostd.logHost management service logs, including virtual machine and host Tasks and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
/var/log/sysboot.logEarly VMkernel startup, module loading, and host initialization.

ESXi 5 Log File Locations:

Log file locationLog file description
/var/log/auth.logESXi Shell authentication success and failure.
/var/log/dhclient.logDHCP client service, including discovery, address lease requests and renewals.
/var/log/esxupdate.logESXi patch and update installation logs.
/var/log/hostd.logHost management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
/var/log/shell.logESXi Shell usage logs, including enable/disable and every command entered.
/var/log/sysboot.logEarly VMkernel startup and module loading.
/var/log/syslog.logManagement service initialization, watchdogs, scheduled tasks and DCUI use.
/var/log/usb.logUSB device arbitration events, such as discovery and pass-through to virtual machines.
/var/log/vob.logVMkernel Observation events, similar to vob.component.event.
/var/log/vmkernel.logCore VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.
/var/log/vmkwarning.logA summary of Warning and Alert log messages excerpted from the VMkernel logs.
/var/log/vmksummary.logA summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption.

Between version 5.0 and 5.1 the log file locations have not changed, but a couple of new logs have been added.

ESXi 5.1 New Log File Locations:

Log file locationLog file description
/var/log/lacp.logLink Aggregation Control Protocol logs
/var/log/hostd-probe.logHost management service responsiveness checker
/var/log/rhttpproxy.logHTTP connections proxied on behalf of other ESXi host webservices.

Clearly the number of host log file has increased in newer versions, and that should make it much easier to find the log entries you are looking for. A more granular logging into different specialized log files can only be a good thing.

Logs from vCenter Server Components on ESXi 5.1:

Log file locationLog file description
/var/log/vpxa.logvCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent
/var/log/fdm.logvSphere High Availability logs, produced by the fdm service

Just remember that ESXi only logs to memory, and that you need to set logging to a syslog server to preserve logs between reboots. If ESXi 5 is installed on local disk, the log files will be persistent through reboots, since it creates a zipped archive in /var/run/log. If ESXi is deployed via Auto Deploy, no local disk is used and the log files are not persistent, and needs to be collected by an external syslog service.

For more details about various VMware products and their log file locations, check VMware Knowledgebase article 1021806 and VMware Knowledgebase article 2032076