ESXi records host activity in log files, using a syslog facility.

Table 1. ESXi Log File Locations
Component Location Purpose
Authentication /var/log/auth.log Contains all events related to authentication for the local system.
ESXi host agent log /var/log/hostd.log Contains information about the agent that manages and configures the ESXi host and its virtual machines.
Shell log /var/log/shell.log Contains a record of all commands typed into the ESXi Shell and shell events (for example, when the shell was enabled).
System messages /var/log/syslog.log Contains all general log messages and can be used for troubleshooting. This information was formerly located in the messages log file.
vCenter Server agent log /var/log/vpxa.log Contains information about the agent that communicates with vCenter Server (if the host is managed by vCenter Server).
Virtual machines The same directory as the affected virtual machine's configuration files, named vmware.log and vmware*.log. For example, /vmfs/volumes/datastore/virtual machine/vmware.log Contains virtual machine power events, system failure information, tools status and activity, time sync, virtual hardware changes, vMotion migrations, machine clones, and so on.
VMkernel /var/log/vmkernel.log Records activities related to virtual machines and ESXi.
VMkernel summary /var/log/vmksummary.log Used to determine uptime and availability statistics for ESXi (comma separated).
VMkernel warnings /var/log/vmkwarning.log Records activities related to virtual machines.
Quick Boot /var/log/loadESX.log Contains all events related to restarting an ESXi host through Quick Boot.
Trusted infrastructure agent /var/run/log/kmxa.log Records activities related to the Client Service on the ESXi Trusted Host.
Key Provider Service /var/run/log/kmxd.log Records activities related to the vSphere Trust Authority Key Provider Service.
Attestation Service /var/run/log/attestd.log Records activities related to the vSphere Trust Authority Attestation Service.
ESX Token Service /var/run/log/esxtokend.log Records activities related to the vSphere Trust Authority ESX Token Service.
ESX API Forwarder /var/run/log/esxapiadapter.log Records activities related to the vSphere Trust Authority API forwarder.