Determining whether an ESXi host has persistent logging
Article ID: 302451
Updated On:
Products
Issue/Introduction
VMware ESXi logs internally to a ramdisk. If configured, the host also logs to a persistent scratch location on disk or to a remote syslog server via the network. Persistent logging survives across reboots of an ESXi host, and is important for troubleshooting.
This articles provides guidance for determining whether an ESXi host has been configured for persistent logging. It also points to documentation or other articles for changing that configuration.
Environment
VMware vSphere ESXi 5.0
VMware ESXi 4.0.x Installable
VMware ESXi 3.5.x Installable
VMware vSphere ESXi 5.5
VMware vSphere ESXi 5.1
VMware ESXi 4.1.x Embedded
VMware ESXi 3.5.x Embedded
VMware ESXi 4.0.x Embedded
Resolution
If an ESXi host has been configured to store logs on a persistent disk or to send them to a remote syslog server via the network, those logs are considered persistent.
Identifying whether an ESXi host is configured to send logs to a syslog server
VMware ESXi hosts can be configured to ship logs remotely to a syslog server for long-term storage. The ESXi host cannot guarantee that the remote syslog server is retaining these logs according to any given retention policy.
Check the configuration of the ESXi host's syslog service. The host should be configured with a remote syslog server's hostname and port. The specific method is dependent on the version of ESXi:
- For ESXi 5.x, controlled by the
Syslog.global.logHostadvanced configuration option. For more information, see Configuring syslog on ESXi 5.x (2003322)
- For ESXi 3.5 and 4.x, controlled by the
Syslog.Remote.HostnameandSyslog.Remote.Portadvanced configuration options. For more information, see Enabling syslog on ESXi 3.5 and 4.x (1016621).
Identifying whether an ESXi host is configured to send logs to a persistent scratch location on disk
VMware ESXi hosts can be configured to copy logs to a local disk device for long-term storage. The ESXi host controls the rotation and retention of these logs.
Check the configuration of the ESXi host's syslog service. The host should be configured with a persistent location on disk to store the logs:
- Validate that the ESXi host has a persistent location on disk which is suitable for storing logs. This could be a Scratch location, or any VMFS Datastore. For more information on configuring a dedicated scratch location, see Creating a persistent scratch location for ESXi (1033696).
- Validate that the ESXi host is configured to redirect logs to the persistent location on disk. The host should be configured with the path to the storage location. The specific configuration option is dependent on the version of ESXi:
-
- For ESXi 5.x, controlled by the
Syslog.global.logDirandSyslog.global.logDirUniqueadvanced configuration options. For more information, Configuring syslog on ESXi 5.x (2003322)
- For ESXi 3.x and 4.x, controlled by the
Syslog.Local.DatastorePathadvanced configuration option. For more information, see Enabling syslog on ESXi 3.5 and 4.x (1016621).
- For ESXi 5.x, controlled by the
Validate that the configured log target is successfully receiving information from the ESXi host
To validate that the target is receiving information:
- Open a console session to the ESXi host.
- Run one of these commands:
- For ESXi 5.x and later:
esxcli system syslog mark --message "Syslog Test Message" - For ESXi 4.1 and earlier:
logger -t vmkernel "Syslog Test Message"
- For ESXi 5.x and later:
- Review the logs on the remote syslog collector or local scratch location, and validate that the test message was received and recorded successfully.
Additional Information
Feedback
