ESXi records host activity in log files, using a syslog facility.
| Component | Location | Purpose |
|---|---|---|
| VMkernel | /var/log/vmkernel.log | Records activities related to virtual machines and ESXi. |
| VMkernel warnings | /var/log/vmkwarning.log | Records activities related to virtual machines. |
| VMkernel summary | /var/log/vmksummary.log | Used to determine uptime and availability statistics for ESXi (comma separated). |
| ESXi host agent log | /var/log/hostd.log | Contains information about the agent that manages and configures the ESXi host and its virtual machines. |
| vCenter agent log | /var/log/vpxa.log | Contains information about the agent that communicates with vCenter Server (if the host is managed by vCenter Server). |
| Shell log | /var/log/shell.log | Contains a record of all commands typed into the ESXi Shell as well as shell events (for example, when the shell was enabled). |
| Authentication | /var/log/auth.log | Contains all events related to authentication for the local system. |
| System messages | /var/log/syslog.log | Contains all general log messages and can be used for troubleshooting. This information was formerly located in the messages log file. |
| Virtual machines | The same directory as the affected virtual machine's configuration files, named vmware.log and vmware*.log. For example, /vmfs/volumes/datastore/virtual machine/vwmare.log | Contains virtual machine power events, system failure information, tools status and activity, time sync, virtual hardware changes, vMotion migrations, machine clones, and so on. |
| Quick Boot | /var/log/loadESX.log | Contains all events related to restarting an ESXi host through Quick Boot. |
