ESXi Log File Formats introduced from vSphere ESXi 8.0

Products

• VMware vSphere ESXi

Issue/Introduction

• Log files format on ESXi 8.0 is slightly different from the one on ESXi 7.0.
• Is there any documentation for the log files formats used in ESXi ? 
• Can I find the formal syntax for this log format (described in a formal language) ?
• Can we revert the format of ESXI 8.0 to that of ESXI 7.0?

Environment

VMware vSphere ESXi 8.0

Resolution

Starting with ESXi 8.0, the format of log files is standardized and is expressed in Augmented Backus-Naur Form (ABNF). Details are described Broadcom product documentation in Log File Formats.

Major difference from the previous version is that new format adds severity, thread-name(program name), opid (process ID) in all syslog based (vmsyslogd) logs.

Severity specify 8 severity levels.

• Em - Emergency
• Al - Alert
• Cr - Critical
• Er - Error
• Wa - Warning
• No - Notice
• In - Informational
• Db - Debug

Examples

• vobd.log

in 7.0

2025-MM-DDThh:mm:ss.483Z: [UserLevelCorrelator] 1019369886505us: [vob.user.ssh.session.opened] SSH session was opened for '[email protected]'.

in 8.0

2025-MM-DDThh:mm:ss.737Z In(14) vobd[2097521]:  [UserLevelCorrelator] 1012726884193us: [vob.user.ssh.session.closed] SSH session was closed for '[email protected]'.

In(14) : shows that severity Informational and 14 is a internally calculated value from severity and facility code.

vobd[2097521] : shows that application name is 'vobd' and pid (wid) of the application is 2097521.

• hostd.log

in 7.0

2025-MM-DDThh:mm:ss.266Z error hostd[265267] [Originator@6876 sub=Default] IpmiIfcOpenIpmiOpen: open(/dev/ipmi0, RDWR) failed 2 m

in 8.0

2025-MM-DDThh:mm:ss.073Z Er(163) Hostd[2098450]: [Originator@6876 sub=Default] IpmiIfcOpenIpmiOpen: open(/dev/ipmi0, RDWR) failed 2 m

• vmkernel.log

in 7.0

2025-MM-DDThh:mm:ss.630Z cpu0:262792)Jumpstart plugin swapobjd activated.

in 8.0

2025-MM-DDThh:mm:ss.810Z In(182) vmkernel: cpu0:2098001)Jumpstart plugin swapobjd activated.

'In(182)' shows that Informational and 'vmkernel' is a program name but no opid (propcess id) which is optional.

Please Note:- This is an expected change on ESXI 8.0: the default on‑wire syslog format was updated and cannot be reverted  to look exactly like ESXi 7.0 again.

• ESXi 8.0 formats outbound syslog in standards‑compliant RFC 3164 or RFC 5424, with slightly different timestamp and header structure compared to 7.0.
• The “old” style line from 7.0 (<14>1 2025‑… vpxd 6847 - - Event [ID] ...) is RFC 5424‑like with structured data for vCenter events.
• The “new” 8.0 style (<38>2025‑… sshd-session[6588162]: Failed password…) is a more traditional BSD/RFC‑3164 style header; the content is still there, but the prefix fields and severity/facility number differ.
• The ...?formatter=RFC_3164 / ...?formatter=RFC_5424 URIs control how ESXi wraps messages when sending them out, but ESXi 8.0 already complies with these RFCs and still does not reproduce the 7.0 “vpxd Event [...]” layout byte‑for‑byte.
• In other words, the formatter flag can switch between the two standards, but it cannot force ESXi 8 to emit logs in the exact legacy 7.0 format.