6.5.1

Table Of Contents
ESXi Log File Locations
ESXi records host activity in log les, using a syslog facility.
Component Location Purpose
VMkernel
/var/log/vmkernel.log
Records activities related to virtual
machines and ESXi.
VMkernel warnings
/var/log/vmkwarning.log
Records activities related to virtual
machines.
VMkernel summary
/var/log/vmksummary.log
Used to determine uptime and
availability statistics for ESXi (comma
separated).
ESXi host agent log
/var/log/hostd.log
Contains information about the agent
that manages and congures the ESXi
host and its virtual machines.
vCenter agent log
/var/log/vpxa.log
Contains information about the agent
that communicates with vCenter
Server (if the host is managed by
vCenter Server).
Shell log
/var/log/shell.log
Contains a record of all commands
typed into the ESXi Shell as well as
shell events (for example, when the
shell was enabled).
Authentication
/var/log/auth.log
Contains all events related to
authentication for the local system.
System messages
/var/log/syslog.log
Contains all general log messages and
can be used for troubleshooting. This
information was formerly located in
the messages log le.
Virtual machines The same directory as the aected
virtual machine's conguration les,
named vmware.log and vmware*.log.
For
example, /vmfs/volumes/datastor
e/virtual machine/vwmare.log
Contains virtual machine power
events, system failure information,
tools status and activity, time sync,
virtual hardware changes, vMotion
migrations, machine clones, and so on.
Configure Log Filtering on ESXi Hosts
The log ltering capability lets you modify the logging policy of the syslog service that is running on an
ESXi host. You can create log lters to reduce the number of repetitive entries in the ESXi logs and to
blacklist specic log events entirely.
Log lters aect all log events that are processed by the ESXi host vmsyslogd daemon, whether they are
recorded to a log directory or to a remote syslog server.
When you create a log lter, you set a maximum number of log entries for the log messages. The logs
messages are generated by one or more specied system components and that match a specied phrase. You
must enable the log ltering capability and reload the syslog daemon to activate the log lters on the ESXi
host.
I Seing a limit to the amount of logging information, restricts your ability to troubleshoot
potential system failures properly. If a log rotate occurs after the maximum number of log entries is reached,
you might lose all instances of a ltered message.
Chapter 10 System Log Files
VMware, Inc. 173