Location of ESXi 5.0 log files

Products

VMware vSphere ESXi

Issue/Introduction

This article provides the default location of log files on an ESXi 5.0 host.

For related information, see the Logging in vSphere 5.0 in Command-Line Management in vSphere 5.0 for Service Console Users.

For ESXi 5.1 and 5.5, see Location of ESXi 5.1 and 5.5 log files (2032076)

For other products and versions, see Location of log files for VMware products (1021806).

Symptoms:

Environment

VMware vSphere ESXi 5.1
VMware vSphere ESXi 5.0

Resolution

You can review ESXi 5.0 host log files:

From the Direct Console User Interface (DCUI). For more information, see About the Direct Console ESXi Interface in the vSphere 5.0 Installation and Setup Guide.
From the ESXi Shell. For more information, see the Log In to the ESXi Shell section in the vSphere 5.0 Installation and Setup Guide.
Using a web browser at https://HostnameOrIPAddress/host. For more information, see the HTTP Access to vSphere Server Files section in the vSphere Web Services SDK documentation.
Within an extracted vm-support log bundle. For more information, see Collecting diagnostic information for VMware ESX/ESXi using the vSphere Client (653) or Collecting diagnostic information for VMware ESX/ESXi using the vm-support command (1010705).
Using the vifs command line utility in the vCLI. For more information, see the vSphere Command-Line Interface documentation.

ESXi 5.0 Host Log Files

Logs for an ESXi 5.0 host are grouped according to the source component:

/var/log/auth.log: ESXi Shell authentication success and failure.
/var/log/dhclient.log: DHCP client service, including discovery, address lease requests and renewals.
/var/log/esxupdate.log: ESXi patch and update installation logs.
/var/log/hostd.log: Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
/var/log/shell.log: ESXi Shell usage logs, including enable/disable and every command entered. For more information, see the Managing vSphere with Command-Line Interfaces section of the vSphere 5 Command Line documentation and Auditing ESXi Shell logins and commands in ESXi 5.x (2004810).
/var/log/sysboot.log: Early VMkernel startup and module loading.
/var/log/boot.gz : A compressed file that contains boot log information and can be read using zcat /var/log/boot.gz|more .
/var/log/syslog.log: Management service initialization, watchdogs, scheduled tasks and DCUI use.
/var/log/usb.log: USB device arbitration events, such as discovery and pass-through to virtual machines.
/var/log/vobd.log: VMkernel Observation events, similar to vob.component.event.

Note: For clarification VOB and the corresponding service VOBD propagates kernel level errors to third-party applications. VOBD is a daemon that VMware and third-party applications use for monitoring and troubleshooting.

/var/log/vmkernel.log: Core VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.
/var/log/vmkwarning.log: A summary of Warning and Alert log messages excerpted from the VMkernel logs.
/var/log/vmksummary.log: A summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption. For more information, see Format of the ESXi 5.0 vmksummary log file (2004566).

Note: For information on sending logs to another location such as a datastore or remote syslog server, see Configuring syslog on ESXi 5.0 (2003322).

Logs from vCenter Server Components on ESXi 5.0

When an ESXi 5.0 host is managed by vCenter Server 5.0, two components are installed, each with its own logs:

/var/log/vpxa.log: vCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent.
/var/log/fdm.log: vSphere High Availability logs, produced by the fdm service. For more information, see the vSphere HA Security section of the vSphere 5.0 Availability Guide.

Note: If persistent scratch space is configured, many of these logs are located on the scratch volume and the /var/log/ directory contains symlinks to the persistent storage location. Rotated logs are compressed at the persistent location and/or at /var/run/log/. For more information, see Creating a persistent scratch location for ESXi (1033696).

Additional Information

“vm-support” command in ESX/ESXi to collect diagnostic information
Location of log files for VMware products
Creating a persistent scratch location for ESXi 4.x/5.x/6.x
Format of the ESXi 5.x vmksummary log file
Auditing ESXi Shell logins and commands
Location of ESXi 5.1 and 5.5 log files
Localização de arquivos de log do ESXi 5.0
Ubicación de los archivos de registro de ESXi 5.0
ESXi 5.0 日志文件的位置
ESXi 5.0 ログファイルの場所
Collecting diagnostic information for VMware ESX/ESXi