6.0.1

Table Of Contents
n
To manage diagnostic data: Global.Licenses
Procedure
1 In the inventory, navigate to a vCenter Server instance and click the Monitor tab.
2 Click System Logs.
3 Click Export System Logs.
4 If you are connected to vCenter Server, select the object for which you want to export data.
Selecting an object selects all of its child objects.
5 If you are connected to vCenter Server, select Include information from vCenter Server and vSphere
Client to download vCenter Server and vSphere Client log files and host log files, and click Next.
6 If the selected host supports manifest driven exports of system log files, select the system log files to
collect. Select the specific system log files to download.
If the host does not support manifest exports of log files, all system log files are exported.
7 Select Gather performance data to include performance data information in the log files. Click
Generate Log Bundle.
You can update the duration and interval time you want the data collected.
8 Once the log bundle generates, click Download Log Bundle to save it to your local computer.
9 Specify the location to which to save the log files.
The host or vCenter Server generates a tar.tgz file containing the log files. The Recent Tasks panel
shows the Generate diagnostic bundles task in progress.
10 Click Save.
The Downloading Log Bundles dialog box appears when the Generating Diagnostic Bundle task is
finished. The download status of each bundle appears in the dialog box.
Some network errors can cause download failures. When you select an individual download in the
dialog box, the error message for that operation appears under the name and location of the log bundle
file.
11 Verify the information in the Summary and click Finish to download the log files.
Diagnostic bundles containing log files for the specified objects are downloaded to the location specified.
Managing ESXi Log Files
Log files are an important component of troubleshooting attacks and obtaining information about breaches
of host security. Logging to a secure, centralized log server can help prevent log tampering. Remote logging
also provides a long-term audit record.
Take the following measures to increase the security of the host.
n
Configure persistent logging to a datastore. By default, the logs on ESXi hosts are stored in the in-
memory file system. Therefore, they are lost when you reboot the host, and only 24 hours of log data is
stored. When you enable persistent logging, you have a dedicated record of server activity available for
the host.
n
Remote logging to a central host allows you to gather log files onto a central host, where you can
monitor all hosts with a single tool. You can also do aggregate analysis and searching of log data, which
might reveal information about things like coordinated attacks on multiple hosts.
n
Configure remote secure syslog on ESXi hosts using a remote command line such as vCLI or PowerCLI,
or using an API client.
Chapter 10 System Log Files
VMware, Inc. 165