Logs generates a detailed set of events that occur within application and it's been an essential part of troubleshooting any issues or performance. In this post we will discuss about the ESXi logs which will help you to keep a track of all the events and in troubleshooting any issues with ESXi.
ESXi host runs a service, syslog, for logging system information. Using this service ESXi host generates tons of events soon after its powered on. Depending on it's type these events will be written to different log files under /var/run/log in the ESXi filesystem.
By default, the logs are stored into a local scratch location of the ESXi host. This scratch partition is created automatically during the ESXi installation and is usually of a size 4 GB.
Below listed are the most frequently used log files on the ESXi host.
Log Rotation -
VMware log files turn over according to the configured settings. For example, if you set the maximum number of log files to 10, after the 10th log file is written, the numbering sequence is reset to zero and the first of 10 log files is overwritten with the most current log entries.
The default setting for ESXi 5.x was to rotate 10 files with a size of 5120 KB each, whereas the default for ESXi 5.1.x, 5.5.x and 6.x is to rotate 10 files with a size of 10240 KB each. Only the logs which are stored locally gets rolled over to prevent the size of log files from getting overly large. Log rotation does not affect remote syslog server log message retention. Rotated logs are compressed at the persistent file location /var/run/log/.
Viewing ESXi log file -
There are different ways you can access ESXi logs as described below -
1. From ESXi Host Client
An easiest way to view the ESXi logs is from ESXi host client. Navigate to Host > Monitor > Logs to view the list of log files available. Select a log file which you need to view and it displays the contents in the underlying pane.
2. From SSH session to the ESXi host
Another way to view log files on VMware ESXi is to SSH to the host and read the files. Take a SSH session to the ESXi host and go to the directory /var/run/log to view the ESXi logs.
3. From ESXi Console
Above 2 methods are useful when we can login to the ESXi hosts(using SSH/Host Client). But what if we are unable to login to the host from SSH/client. The only way in this case is to login to the ESXi console(iDRAC/iLO) and check the ESXi logs to troubleshoot the issue.
This method is useful to troubleshoot the ESXi boot issues.
For more information on log rotation and modifying logging levels you can refer to this VMware KB.
I hope you will now have a basic understanding about some of the log files generated by ESXi Host and how they are used to troubleshoot any issues. We will discuss more about different methods of generating a log bundle in another post.
*** Explore | Share | Grow ***
Opmerkingen