Viewing the command history in ESX/ESXi

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides information on viewing the command history to determine the commands that were run on the ESX/ESXi host.

Environment

VMware ESXi 4.1.x Embedded
VMware vSphere ESXi 5.5
VMware ESX Server 3.5.x
VMware ESXi 3.5.x Embedded
VMware vSphere ESXi 7.0.0
VMware ESXi 4.0.x Embedded
VMware ESX 4.0.x
VMware vSphere ESXi 6.7
VMware ESX 4.1.x
VMware vSphere ESXi 6.5
VMware vSphere ESXi 6.0
VMware vSphere ESXi 5.0
VMware vSphere ESXi 5.1
VMware ESXi 3.5.x Installable
VMware ESXi 4.1.x Installable
VMware ESXi 4.0.x Installable

Resolution

• In ESXi 5.x and above the shell commands are logged in the shell.log file located at /var/log/.
   
• In ESXi 4.x, the shell commands are logged in the messages log file. To view the shell commands, run this command:
  
  grep shell /var/log/messages
   
• In ESX, you can find the commands that were run by using the history command. This information is also available in the /root/.bash_history file.
  
  Note: The .bash_history file is not included when gathering a host support bundle. If you want VMware Support to analyze the .bash_history file, copy it manually and attach it to your Support Request.

Additional Information

For more information on gathering logs from your ESXi/ESX hosts, see Collecting diagnostic information for VMware products (1008524).
Collecting diagnostic information for VMware products