How to detect the time skew between the ESXi logs and the vCenter logs
search cancel

How to detect the time skew between the ESXi logs and the vCenter logs

book

Article ID: 304797

calendar_today

Updated On:

Products

VMware vCenter Server VMware vSphere ESXi

Issue/Introduction

The purpose of this article is to explain how to determine the amount of time skew between an ESXi host and the associated vCenter Server, from the logs. For example, when you need to cross reference tasks and events in vCenter Server with relevant log entries in the ESXi host logs.

Resolution

Time Zone

ESXi uses UTC exclusively for the time zone. vCenter vpxd logs include the UTC offset in the time stamp for each message. This example, from Spain, shows +01:00 as the UTC offset:
2013-11-06T12:50:30.453+01:00 [05148 info 'vpxdvpxdVmomi'] ...

To calculate the corresponding time frame in the ESXi logs, subtract the offset to acquire the equivalent time stamp to look for in the ESXi logs. For example, the equivalent ESXi log time stamp for the above vpxd extract is:
2013-11-06T11:50:30

Time skew threshold

Besides the time zone difference, there is another factor to consider when calculating time skew between vCenter Server and the ESXi host. Regular host synchronization operations occur between the vpxa agent running on the ESXi host and the vpxd daemon running on the vCenter Server. Each time this host synchronization occurs, the time is compared between them. If the time difference is more than one second (the default threshold), then the ESXi host logs the difference, in seconds to /var/log/vpxa.log.


Here are some example entries from vpxa.log

This line indicates that a host sync is running:
2013-11-14T15:21:35.921Z [6FC55B90 verbose 'VpxProfiler' opID=HB-host-6621@8695-d8140981-cd] [1+] VpxaMoService::GetChanges
 
This line, if it exists, shows the time skew value:
2013-11-14T15:21:35.921Z [6FC55B90 verbose 'vpxavpxaMoService' opID=HB-host-6621@8695-d8140981-cd] [VpxaMoService::GetChangesInt] time difference between vpxd and vpxa is -7 seconds

The vpxa entry indicates that the vCenter Server is 7 seconds behind the ESXi host time.
 
Note: If this line is not present, the time is in sync (within one second or the configured threshold value), not including the time zone difference.



Additional Information

The time skew threshold is adjustable via the advanced configuration option: vpxa.timeDiffThreshold. The default value is one second.