Determining whether an ESXi host has persistent logging

Products

• VMware vSphere ESXi

Issue/Introduction

VMware ESXi logs internally to a ramdisk. If configured, the host also logs to a persistent scratch location on disk or to a remote syslog server via the network. Persistent logging survives across reboots of an ESXi host, and is important for troubleshooting.

This articles provides guidance for determining whether an ESXi host has been configured for persistent logging. It also points to documentation or other articles for changing that configuration.

Environment

VMware ESXi 8.x

VMware ESXi 7.x

VMware ESXi 6.x

 

Resolution

If an ESXi host has been configured to store logs on a persistent disk or to send them to a remote syslog server via the network, those logs are considered persistent.

Identifying whether an ESXi host is configured to send logs to a syslog server

VMware ESXi hosts can be configured to ship logs remotely to a syslog server for long-term storage. The ESXi host cannot guarantee that the remote syslog server is retaining these logs according to any given retention policy.

Check the configuration of the ESXi host's syslog service as there are multiple configuration options available depending on the version of ESX or ESXi you are running:

• For ESXi 6.x+ , has 5 configuration options,  for more information on the different options see  Configuring syslog on ESXi (318939)

Identifying whether an ESXi host is configured to send logs to a persistent scratch location on disk

VMware ESXi hosts can be configured to copy logs to a local disk device for long-term storage. The ESXi host controls the rotation and retention of these logs.

Check the configuration of the ESXi host's syslog service. The host should be configured with a persistent location on disk to store the logs:

1. Validate that the ESXi host has a persistent location on disk which is suitable for storing logs. This could be a Scratch location, or any VMFS Datastore. For more information on configuring a dedicated scratch location, see Creating a persistent scratch location for ESXi 8.x/7.x/6.x (317689) 

Validate that the configured log target is successfully receiving information from the ESXi host

To validate that the target is receiving information:

1. Open a console session to the ESXi host.
2. Run one of these commands:
   
   
   • For ESXi 5.x and later: esxcli system syslog mark --message "Syslog Test Message"
   • For ESXi 4.1 and earlier: logger -t vmkernel "Syslog Test Message"
3. Review the logs on the remote syslog collector or local scratch location, and validate that the test message was received and recorded successfully.

Additional Information

Configuring syslog on ESXi (318939)