6.0.1

Component Location Purpose
Shell log
/var/log/shell.log
Contains a record of all commands
typed into the ESXi Shell as well as
shell events (for example, when the
shell was enabled).
Authentication
/var/log/auth.log
Contains all events related to
authentication for the local system.
System messages
/var/log/syslog.log
Contains all general log messages and
can be used for troubleshooting. This
information was formerly located in
the messages log file.
Virtual machines The same directory as the affected
virtual machine's configuration files,
named vmware.log and vmware*.log.
For
example, /vmfs/volumes/datastor
e/virtual machine/vwmare.log
Contains virtual machine power
events, system failure information,
tools status and activity, time sync,
virtual hardware changes, vMotion
migrations, machine clones, and so on.
Configure Log Filtering on ESXi Hosts
The log filtering capability lets you modify the logging policy of the syslog service that is running on an
ESXi host. You can create log filters to reduce the number of repetitive entries in the ESXi logs and to
blacklist specific log events entirely.
Log filters affect all log events that are processed by the ESXi host vmsyslogd daemon, whether they are
recorded to a log directory or to a remote syslog server.
When you create a log filter, you set a maximum number of log entries for the log messages that are
generated by one or more specified system components and that match a specified phrase. You must enable
the log filtering capability and reload the syslog daemon to activate the log filters on the ESXi host.
IMPORTANT If you set a limit to the amount of logging information, you might be unable to properly
troubleshoot potential system failures. If a log rotate occurs after the maximum number of log entries is
reached, you might lose all instances of a filtered message.
Procedure
1 Log in to the ESXi Shell as root.
2 In the /etc/vmware/logfilters file, add the following entry to create a new log filter.
numLogs | ident | logRegexp
where:
n
numLogs sets the maximum number of log entries for the specified log messages. After reaching
this number, the specified log messages are filtered and ignored. Use 0 to filter and ignore all the
specified log messages.
n
ident specifies one or more system components to apply the filter to the log messages that these
components generate. For information about the system components that generate log messages,
see the values of the idents parameters in the syslog configuration files that are located in
the /etc/vmsyslog.conf.d directory. Use a comma-separated list to apply a filter to more than one
system component. Use * to apply a filter to all system components.
vSphere Monitoring and Performance
170 VMware, Inc.