ESXi Log Files

Log files are an important component of troubleshooting attacks and obtaining information about breaches. All ESXi hosts run a syslog service, which logs messages from the VMkernel and other system components to local files or to a remote host.

To increase the security of the host, take the following measures.

• Configure persistent logging to a datastore. By default, the logs on ESXi hosts are stored in the in-memory file system. Therefore, they are lost when you reboot the host, and only 24 hours of log data is stored. When you enable persistent logging, you have a dedicated activity record for the host.
• Remote logging to a central host allows you to gather log files on a central host. From that host, you can monitor all hosts with a single tool, do aggregate analysis, and search log data. This approach facilitates monitoring and reveals information about coordinated attacks on multiple hosts.
• Configure the remote secure syslog on ESXi hosts by using ESXCLI or PowerCLI, or by using an API client.
• Query the syslog configuration to make sure that the syslog server and port are valid.

See the vSphere Monitoring and Performance documentation for information about syslog setup, and for additional information on ESXi log files.