ESXi records host activity in log files, using a syslog facility.
Component | Location | Purpose |
---|---|---|
VMkernel | /var/log/vmkernel.log | Records activities related to virtual machines and ESXi. |
VMkernel warnings | /var/log/vmkwarning.log | Records activities related to virtual machines. |
VMkernel summary | /var/log/vmksummary.log | Used to determine uptime and availability statistics for ESXi (comma separated). |
ESXi host agent log | /var/log/hostd.log | Contains information about the agent that manages and configures the ESXi host and its virtual machines. |
vCenter agent log | /var/log/vpxa.log | Contains information about the agent that communicates with vCenter Server (if the host is managed by vCenter Server). |
Shell log | /var/log/shell.log | Contains a record of all commands typed into the ESXi Shell as well as shell events (for example, when the shell was enabled). |
Authentication | /var/log/auth.log | Contains all events related to authentication for the local system. |
System messages | /var/log/syslog.log | Contains all general log messages and can be used for troubleshooting. This information was formerly located in the messages log file. |
Virtual machines | The same directory as the affected virtual machine's configuration files, named vmware.log and vmware*.log. For example, /vmfs/volumes/datastore/virtual machine/vwmare.log | Contains virtual machine power events, system failure information, tools status and activity, time sync, virtual hardware changes, vMotion migrations, machine clones, and so on. |