Objective 6.1 – Configure, Manage, and Analyze vSphere Log Files

Knowledge - Identify vCenter Server log file names and locations
VMware Article Link extract
Windows- C:\ProgramData\VMware\VMware VirtualCenter\Logs\
Appliance - /var/log/vmware/vpx/

•  vpxd.log: The main vCenter Server logs, consisting of all vSphere Client and WebServices connections, internal tasks and events, and communication with the vCenter Server Agent (vpxa) on managed ESX/ESXi hosts.
• vpxd-profiler.log, profiler.log and scoreboard.log: Profiled metrics for operations performed in vCenter Server. Used by the VPX Operational Dashboard (VOD) accessible at https://VCHostnameOrIPAddress/vod/index.html.
• vpxd-alert.log: Non-fatal information logged about the vpxd process.
• cim-diag.log and vws.log: Common Information Model monitoring information, including communication between vCenter Server and managed hosts' CIM interface.
• drmdump\: Actions proposed and taken by VMware Distributed Resource Scheduler (DRS), grouped by the DRS-enabled cluster managed by vCenter Server. These logs are compressed.
• ls.log: Health reports for the Licensing Services extension, connectivity logs to vCenter Server.
• vimtool.log: Dump of string used during the installation of vCenter Server with hashed information for DNS, username and output for JDBC creation.
• stats.log: Provides information about the historical performance data collection from the ESXi/ESX hosts
• sms.log: Health reports for the Storage Monitoring Service extension, connectivity logs to vCenter Server, the vCenter Server database and the xDB for vCenter Inventory Service.
• eam.log: Health reports for the ESX Agent Monitor extension, connectivity logs to vCenter Server.
• catalina.<date>.log and localhost.<date>.log: Connectivity information and status of the VMware Webmanagement Services.
• jointool.log: Health status of the VMwareVCMSDS service and individual ADAM database objects, internal tasks and events, and replication logs between linked-mode vCenter Servers.
• manager.<date>.log
• host-manager.<date>.log

Knowledge - Identify ESXi log files names and locations
VMware Article Link extract

• /var/log/auth.log: ESXi Shell authentication success and failure.
• /var/log/dhclient.log: DHCP client service, including discovery, address lease requests and renewals.
• /var/log/esxupdate.log: ESXi patch and update installation logs.
• /var/log/hostd.log: Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
• /var/log/shell.log: ESXi Shell usage logs, including enable/disable and every command entered
• /var/log/sysboot.log: Early VMkernel startup and module loading.
• /var/log/boot.gz : A compressed file that contains boot log information and can be read using zcat /var/log/boot.gz|more .
• /var/log/syslog.log: Management service initialization, watchdogs, scheduled tasks and DCUI use.
• /var/log/usb.log: USB device arbitration events, such as discovery and pass-through to virtual machines.
• /var/log/vobd.log: VMkernel Observation events, similar to vob.component.event
• /var/log/vmkernel.log: Core VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.
• /var/log/vmkwarning.log: A summary of Warning and Alert log messages excerpted from the VMkernel logs.
• /var/log/vmksummary.log: A summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption.
• /var/log/vpxa.log: vCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent.
• /var/log/fdm.log: vSphere High Availability logs, produced by the fdm service.

Knowledge - Identify tools used to view vSphere log files
The vSphere Client – Click Home > Administration > System Logs.


Skills and Abilities - Generate vCenter Server and ESXi log bundles
Log into the vSphere client, Click File from the top menu > click Export > click Export System Logs…
Select at which level you want to export logs from. Select the topmost object (the vCenter object) to export ALL logs > leave the checkbox Include Information from vCenter and vSphere Client if you want to also export those logs.

If you require you can gather directly from the ESXi host via HTTP.

Skills and Abilities - Use esxcli System syslog to Configure Centralized Logging On ESXi Hosts

Skills and Abilities - Test Centralized Logging Configuration
Once syslog collector is setup,  configure your ESXi host as above and send a test message to log which will redirect to the remote.

    esxcli system syslog mark --message="test syslog is working"

Skills and Abilities - Analyze Log Entries To Obtain Configuration Information
Tough to detail,  but only thing to say is ensure your connected to the correct log file if they are rolled.

Skills and Abilities - Analyze Log Entries To Identify And Resolve Issues
Tough to detail,  but only thing to say is ensure your connected to the correct log file if they are rolled.

Skills and Abilities - Install and configure VMware syslog Collector and ESXi Dump Collector
The VMware vSphere syslog Collector service allows for collecting diagnostic information from a all hosts in a central place.  Following video shows how to configuring a remote syslog collector to accept logs sent from hosts.  To note when remote logging is tested at the end while ESXi host was set to send to this remote collector,  syslog firewall was not initially open to allow host to communicate to collector.

The VMware vSphere Network Dump Collector service allows for collecting diagnostic information from a host that experiences a critical fault and generates a purple diagnostic screen.  Due to time constraints I have not configured this yet,  but the details to do so are found here