Location and Contents of ESXi log files
search cancel

Location and Contents of ESXi log files

book

Article ID: 306962

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

This article outlines the default locations for ESXi host logs and briefly describes the contents of each file.

Environment

VMware vSphere ESXi

Resolution

Logs for the ESXi host are grouped according to the source component and can be found in /var/run/log in ESXi host. The below mentioned logs are not an exhaustive list:

  • auth.log: ESXi Shell authentication success and failure.

  • dhclient.log: DHCP client service, including discovery, address lease requests and renewals.

  • esxupdate.log: ESXi patch and update installation logs.

  • lacp.log: Link Aggregation Control Protocol logs.

  • hostd.log: Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.

  • hostd-probe.log: Host management service responsiveness checker.

  • rhttpproxy.log: HTTP connections proxied on behalf of other ESXi host webservices.

  • shell.log: ESXi Shell usage logs, including enable/disable and every command entered. For more information, see Auditing ESXi Shell logins and commands.

  • sysboot.log: Early VMkernel startup and module loading.

  • boot.gz: A compressed file that contains boot log information and can be read using zcat /var/log/boot.gz|more.

  • syslog.log: Management service initialization, watchdogs, scheduled tasks and DCUI use.

  • usb.log: USB device arbitration events, such as discovery and pass-through to virtual machines.

  • vobd.log: VMkernel Observation events, similar to vob.component.event.

  • vmkernel.log: Core VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.

  • vmkwarning.log: A summary of Warning and Alert log messages excerpted from the VMkernel logs.

  • vmksummary.log: A summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption. 
  • Xorg.log: Video acceleration.

  • vpxa.log: vCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent.

  • fdm.log: vSphere High Availability logs, produced by the fdm service.

  • catalog.log: Records component catalog initialization and metadata updates for the ESXi host.

  • clomd-whatif.log: Records cluster-level object manager (CLOM) simulation calculations for vSAN component placement and capacity.

  • drivervm-init.log: Logs the initialization sequence of driver VMs, typically used in architectures involving SmartNICs/DPUs (vSphere Distributed Services Engine).

  • entropyd.log: Records events from the entropy gathering daemon, which supplies randomness for cryptographic operations on the host.

  • envoy-access.log: Logs HTTP/API access requests managed by the Envoy proxy running on the ESXi host (often part of modern vSphere or NSX services).

  • esxio-commd.log: Records communication operations for ESXi I/O capabilities, managing the messaging between the ESXi host and DPU/SmartNIC hardware.

  • hbrsrv.log: Records activities of the Host-Based Replication (HBR) server service, managing vSphere Replication traffic on the host.

  • nvmeauth.log: Logs NVMe over Fabrics (NVMe-oF) secure authentication events (such as DH-HMAC-CHAP) between the host and NVMe storage arrays.

  • sandboxd.log: Records events from the sandbox daemon, which manages the restricted execution environments for specific ESXi user-world processes.

  • sensord.log: Logs hardware sensor readings (temperature, fans, power) and IPMI/CIM polling activities from the host's physical hardware baseboard.

  • vds-vsipioctl.log: Records configuration commands and state changes applied to the vSphere Distributed Switch (vDS) via the vsipioctl utility.

  • vmkmemstats.log: Records periodic snapshots of VMkernel memory statistics, heap usage, and memory allocation data.

  • vmsyslogd-dropped.log: Logs instances where the ESXi syslog service had to drop log messages due to buffer overflows or an unreachable destination.

  • vsantraced.log: Records the operational status of the vSAN trace daemon, which generates the highly detailed .gz vSAN performance and debug traces.

  • watchdog.log: Logs operations of the ESXi watchdog daemon, which monitors critical system services and restarts them if they hang or crash.

For ESXi version specific information on Log files, refer to the below links:

For ESXi version specific information on Log files for legacy versions, review the below documents:

Additional Information

For information on sending logs to another location (such as a datastore or remote syslog server), see Configuring syslog on ESXi.

For other products and versions, see Location of log files for Broadcom products.

For collecting ESXi diagnostic information using vm-support, see "vm-support” command in ESXi to collect diagnostic information.

For information on ESXi shell login and commands, see Auditing ESXi Shell logins and commands.

Powered by Wolken Software