ESXi records host activity in log files, using a syslog facility.

Component Location Purpose
VMkernel /var/log/vmkernel.log Records activities related to virtual machines and ESXi.
VMkernel warnings /var/log/vmkwarning.log Records activities related to virtual machines.
VMkernel summary /var/log/vmksummary.log Used to determine uptime and availability statistics for ESXi (comma separated).
ESXi host agent log /var/log/hostd.log Contains information about the agent that manages and configures the ESXi host and its virtual machines.
vCenter agent log /var/log/vpxa.log Contains information about the agent that communicates with vCenter Server (if the host is managed by vCenter Server).
Shell log /var/log/shell.log Contains a record of all commands typed into the ESXi Shell as well as shell events (for example, when the shell was enabled).
Authentication /var/log/auth.log Contains all events related to authentication for the local system.
System messages /var/log/syslog.log Contains all general log messages and can be used for troubleshooting. This information was formerly located in the messages log file.
Virtual machines The same directory as the affected virtual machine's configuration files, named vmware.log and vmware*.log. For example, /vmfs/volumes/datastore/virtual machine/vwmare.log Contains virtual machine power events, system failure information, tools status and activity, time sync, virtual hardware changes, vMotion migrations, machine clones, and so on.