VMware technical support might request several files to help resolve technical issues. The following sections describe script processes for generating and collecting some of these files.

Set Verbose Logging

You can set the verbose log file specification

You can set verbose logging for vpxd logs.

Procedure

  1. Select a vCenter Server instance.
  2. Click Configure tab.
  3. Click General and in the vCenter Server Settings, click EDIT.
  4. In the Edit vCenter general settings window, Click Logging Settings and select verbose from the Log level drop down menu.
  5. Click SAVE.

Collect vSphere Log Files

You can collect vSphere log files in to a single location.

You can download the log bundle from vSphere Client connected to a vCenter Server system.

Procedure

  1. In vSphere Client menu, select Administration > Deployment > System Configuration.
  2. Select a vCenter Server node and click Export Support Bundle.
  3. Select the support bundle type:
    • Full Support Bundle: Contains information on all services.
    • Minimal Support Bundle: Contains basic product and configuration information.
    • Custom Support Bundle: Contains customized information. Select any of the manifest properties to download the corresponding log files.
  4. Click EXPORT.
  5. (Optional) You can also download the vCenter log bundle using another method:
    1. Right click vCenter Server instance and click Actions > Export System Logs....
    2. Click Select hosts to put selected host logs into an export bundle. Check Include vCenter Server and vSphere UI Client logs to optionally include vCenter Server and vSphere UI logs in the bundle. Click NEXT.
    3. Click Select logs to select specific system logs to export. Click EXPORT LOGS.
    Note: The log bundle is generated as a .zip file. By default, the vpxd logs within the bundle are compressed as .tgz files. You must use gunzip to uncompress these files.

Collect ESXi Log Files

You can collect and package all relevant ESXi system and configuration information, a well as ESXi log files. This information can be used to analyze the problems.

Procedure

  • ♦ Run the following script on the ESXi Shell: /usr/bin/vm-support
    The resulting file has the following format: esx-date-unique-xnumber.tgz

ESXi Log File Locations

ESXi records host activity in log files, using a syslog facility.

Table 1. ESXi Log File Locations
Component Location Purpose
Authentication /var/log/auth.log Contains all events related to authentication for the local system.
ESXi host agent log /var/log/hostd.log Contains information about the agent that manages and configures the ESXi host and its virtual machines.
Shell log /var/log/shell.log Contains a record of all commands typed into the ESXi Shell and shell events (for example, when the shell was enabled).
System messages /var/log/syslog.log Contains all general log messages and can be used for troubleshooting. This information was formerly located in the messages log file.
vCenter Server agent log /var/log/vpxa.log Contains information about the agent that communicates with vCenter Server (if the host is managed by vCenter Server).
Virtual machines The same directory as the affected virtual machine's configuration files, named vmware.log and vmware*.log. For example, /vmfs/volumes/datastore/virtual machine/vmware.log Contains virtual machine power events, system failure information, tools status and activity, time sync, virtual hardware changes, vMotion migrations, machine clones, and so on.
VMkernel /var/log/vmkernel.log Records activities related to virtual machines and ESXi.
VMkernel summary /var/log/vmksummary.log Used to determine uptime and availability statistics for ESXi (comma separated).
VMkernel warnings /var/log/vmkwarning.log Records activities related to virtual machines.
Quick Boot /var/log/loadESX.log Contains all events related to restarting an ESXi host through Quick Boot.
Trusted infrastructure agent /var/run/log/kmxa.log Records activities related to the Client Service on the ESXi Trusted Host.
Key Provider Service /var/run/log/kmxd.log Records activities related to the vSphere Trust Authority Key Provider Service.
Attestation Service /var/run/log/attestd.log Records activities related to the vSphere Trust Authority Attestation Service.
ESX Token Service /var/run/log/esxtokend.log Records activities related to the vSphere Trust Authority ESX Token Service.
ESX API Forwarder /var/run/log/esxapiadapter.log Records activities related to the vSphere Trust Authority API forwarder.

Configure Log Filtering on ESXi Hosts

The log filtering capability lets you modify the logging policy of the syslog service that is running on an ESXi host.

Starting with vSphere 7.0 Update 2, you can add log filters and enable log filtering by using ESXCLI. A log filter, once established, remains in place until it is removed, even across ESXi reboots.

Log filters affect all log events that are processed by the ESXi host vmsyslogd service, whether they are recorded to a log directory or to a remote syslog server.

You must enable the log filtering capability and reload the syslog daemon to activate the log filters on the ESXi host.

ESXCLI commands to configure log filters follow this pattern: esxcli system syslog config logfilter {cmd} [cmd options].

For example, to get the list of available log filters, run the following command: [root@xxx-xx-dhcp-xx-xx:~] esxcli system syslog config logfilter list.

Use the set command to activate or deactivate log filtering: [root@xxx-xx-dhcp-xx-xx:~] esxcli system syslog config logfilter set.

Use the add command to add a log filter and the remove command to remove a log filter.

Use the get command to determine if log filtering is enabled.

A log filter is specified by three components and uses the following syntax: numLogs | ident | logRegexp.

Parameter Description
numLogs Specifies the number of matches of the logRegexp Python regular expression that will be allowed before filtering begins.
ident

The ident string is how an application identifies itself to the syslog facility. The logRegexp filter must be associated with the same application. You can find the ident string of an application by inspecting the log files in /var/run/log. The third field of each log file begins with the ident string and ends with [.
logRegexp Python regular expression that identifies the messages which you want to filter out.

For example, to filter out all messages from the hostd daemon that contain the word "mark" after the tenth occurrence, use the following command: esxcli system syslog config logfilter add --filter="10|Hostd|mark".

To remove the log filter, use the command esxcli system syslog config logfilter remove --filter="10|Hostd|mark".

For more information, see ESXi Syslog Options.

Prerequisites

You can create log filters to reduce the number of repetitive entries in the ESXi logs and to denylist specific log events entirely.

Install ESXCLI. See Getting Started with ESXCLI. For troubleshooting, run esxcli commands in the ESXi Shell.

Turn Off Compression for vpxd Log Files

By default, vCenter Server vpxd log files are rolled up and compressed into .gz files. You can turn off this setting to leave the vpxd logs uncompressed.

Procedure

  1. Log in to the vCenter Server using the vSphere Client.
  2. Select Administration > vCenter Server Settings.
  3. Select Advanced Settings.
  4. In the Key text box, type log.compressOnRoll.
  5. In the Value text box, type false.
  6. Click Add, and click OK.

ESXi VMkernel Files

If the VMkernel fails, an error message appears and then the virtual machine reboots. If you specified a VMware core dump partition when you configured your virtual machine, the VMkernel also generates a core dump and error log.

More serious problems in the VMkernel can freeze the machine without an error message or core dump.