Location and Contents of vCenter Server log files
search cancel

Location and Contents of vCenter Server log files

book

Article ID: 312194

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

This article outlines the default locations for vCenter Server logs and briefly describes the contents of each file.

Environment

VMware vCenter Server 6.7.x
VMware vCenter Server 7.x
VMware vCenter Server 8.x

Resolution

The vCenter Server logs are placed in a different directory on disk depending on the vCenter Server version and the deployed platform.

  • vCenter Server 6.x on Windows - C:\ProgramData\VMware\vCenterServer\Logs\<Service Name>
  • vCenter Server Appliance - /var/log/vmware/<Service Name>

Note: VMware deprecated vCenter Server for Windows in vSphere 6.7. Starting with vSphere 7.0, the vCenter Server Appliance (vCSA) running on Photon OS is the only available deployment option.

vCenter Server logs are grouped by component and purpose. The below mentioned logs are not an exhaustive list:

  • vpxd.log: The main vCenter Server log, consisting of all vSphere Client and WebServices connections, internal tasks and events, and communication with the vCenter Server Agent (vpxa) on managed ESXi hosts.
     
  • vpxd-profiler.log, profiler.log, and scoreboard.log: Profiled metrics for operations performed in vCenter Server. Used by the VPX Operational Dashboard (VOD) accessible at https://VCHostnameOrIPAddress/vod/index.html.
     
  • vpxd-alert.log: Non-fatal information logged about the vpxd process (no longer present in 6.7/7.0/8.0)
     
  • cim-diag.log and vws.log: Common Information Model monitoring information, including communication between vCenter Server and managed hosts' CIM interface.
     
  • drmdump: Actions proposed and taken by VMware Distributed Resource Scheduler (DRS), grouped by the DRS-enabled cluster managed by vCenter Server. These logs are compressed.
     
  • ls.log: Health reports for the Licensing Services extension, connectivity logs to vCenter Server.
     
  • vimtool.log: Dump of strings used during the installation of vCenter Server with hashed information for DNS, username and output for JDBC creation.
     
  • stats.log: Provides information about the historical performance data collection from the ESXi hosts
     
  • sms.log: Health reports for the Storage Monitoring Service extension, connectivity logs to vCenter Server
     
  • eam.log: Health reports for the ESXi Agent Monitor extension, connectivity logs to vCenter Server
     
  • catalina.date.log and localhost.date.log: Connectivity information and status of the VMware Webmanagement Services
     
  • jointool.log: Health status of the VMwareVCMSDS service and individual ADAM database objects, internal tasks and events, and replication logs between linked-mode vCenter Servers.

  • aide.log: Records events from the Advanced Intrusion Detection Environment (AIDE) regarding file integrity checks.

  • dnf.librepo.log, dnf.log, dnf.rpm.log: Records DNF package manager activities, including repository metadata downloads, package transactions, and RPM installations.

  • envoy-hgw-stats-*.log, envoy-sidecar-stats-*.log, envoy-stats-*.log: Records traffic statistics and internal routing data for the Envoy reverse proxy mesh used within vCenter.

  • error.log: A general error log that records HTTP or generic system service failures, often tied to appliance management.

  • hawkey.log: Records package dependency resolution actions taken by the Hawkey library (the backend for the DNF package manager).

  • install-os-rpms.log: Records the installation of base operating system RPM packages during a major update or initial VCSA deployment.

  • mkinitrd-*.log: Records the process of creating the initial ramdisk (initrd) for specific Photon OS Linux kernel versions (e.g., 5.10.x).

  • partitions.log: Records disk partitioning operations and volume layouts on the VCSA storage.

  • postthaw.log, postthaw_*_stderr.log, postthaw_*_stdout.log: Records the execution and output (standard and error) of VMware Tools "thaw" scripts, which resume application I/O after a snapshot.

  • prefreeze.log, prefreeze_*_stderr.log, prefreeze_*_stdout.log: Records the execution and output of VMware Tools "freeze" scripts, which pause/quiesce application I/O right before a snapshot is taken.

  • restore.log: Records the sequence of events, tasks, and configurations applied when recovering a vCenter Server from a file-based backup.

  • rpm-install.log: Records low-level, direct installations of RPM packages on the appliance, bypassing higher-level managers like DNF.

  • untar.log: Records the extraction process of .tar archive files, typically used when staging patches or updates.

  • vmw_snmp_firewall.log: Records firewall configuration changes and access events specifically tied to the VMware SNMP agent port.

  • vmw_snmp_service.log: Records operational status, startups, shutdowns, and errors of the vCenter SNMP service.
  • Additional log files:
    • manager.date.log
    • host-manager.date.log

    Note: As each log grows, it is rotated over a series of numbered component-nnn.log files. On some platforms, the rotated logs are compressed.

vCenter Server logs can be generated from:

  • The vSphere Client connected to vCenter Server 6.x/7.x/8.x: Click Home > Administration > System Logs.

Additional Information

For related information, see the main article in this series:

Additional references:

Powered by Wolken Software