Vsphere 5 : Location of ESXi 5.0 log files

This article provides the default location of log files on an ESXi 5.0 host.

You can review ESXi 5.0 host log files:

• From the Direct Console User Interface (DCUI).
• From the ESXi Shell.
• Using a web browser at https://HostnameOrIPAddress/host.
• Within an extracted vm-support log bundle.
• Using the vifs command line utility in the vCLI.

ESXi 5.0 Host Log Files

Logs for an ESXi 5.0 host are grouped according to the source component:

• /var/log/auth.log: ESXi Shell authentication success and failure.
• /var/log/dhclient.log: DHCP client service, including discovery, address lease requests and renewals.
• /var/log/esxupdate.log: ESXi patch and update installation logs.
• /var/log/hostd.log: Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.
• /var/log/shell.log: ESXi Shell usage logs, including enable/disable and every command entered.
• /var/log/sysboot.log: Early VMkernel startup and module loading.
• /var/log/syslog.log: Management service initialization, watchdogs, scheduled tasks and DCUI use.
• /var/log/usb.log: USB device arbitration events, such as discovery and pass-through to virtual machines.
• /var/log/vob.log: VMkernel Observation events, similar to vob.component.event.
• /var/log/vmkernel.log: Core VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.
• /var/log/vmkwarning.log: A summary of Warning and Alert log messages excerpted from the VMkernel logs.
• /var/log/vmksummary.log: A summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption.

Logs from vCenter Server Components on ESXi 5.0

When an ESXi 5.0 host is managed by vCenter Server 5.0, two components are installed, each with its own logs:

• /var/log/vpxa.log: vCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent.
• /var/log/fdm.log: vSphere High Availability logs, produced by the fdm service..

Note: If persistent scratch space is configured, many of these logs will be located on the scratch volume and the /var/log/ directory will contain symlinks to the persistent storage location. Rotated logs will be compressed at the persistent location and/or at /var/run/log/.