Log file locations in VMware Infrastructure 3

Whenever I am troubleshooting a problem with my VMware ESX hosts I find myself frequently having to look up the location of various VMware Infrastructure 3 (VI3) log files. To try and make this easier for myself and others I’ve decided to put together a list of all the log files that you might use that reside on your ESX host servers and vCenter Servers.

VMware ESX host logs:

• /var/log/vmkernel - VMkernel log, records activities related to the virtual machines and ESX hosts. Rotated with a numeric extension, current log has no extension and the next newest one has a .1 extension
• /var/log/vmkwarning - VMkernel Warnings log, records activities with the virtual machines, a subset of the vmkernel log and uses the same rotation scheme.
• /var/log/vmksummary - VMkernel Summary log, used to determine uptime and availability statistics for ESX hosts human-readable summary found in /var/log/vmksummary.txt.
• /var/log/vmware/hostd.log - ESX Server host agent log, contains information on the agent that manages and configures the ESX host and its virtual machines. (Search the file date/time stamps to find the log file it is currently outputting to, or open hostd.log which is linked to the current log file.)
• /var/log/vmware/esxcfg-firewall.log - ESX Firewall log, logs all firewall rule events. Rotated with a numeric extension, current log has no extension and the next newest one has a .1 extension.
• /var/log/vmware/esxcfg-boot.log - ESX Boot log, logs all ESX boot events. Rotated with a numeric extension, current log has no extension and the next newest one has a .1 extension.
• /var/log/vmware/esxupdate.log - ESX Update log, logs all updates done through the esxupdate tool.
• /var/log/messages - Service console log, contains all general log messages used to troubleshoot virtual machines or an ESX host.
• /var/log/vmware/webAccess - Web Access log, records information on Web-based access to an ESX host.
• /var/log/vmware/aam - High Availability (HA) log, logs information related to the High Availability service. In ESX 3.0.x these logs were in /opt/LGTOaam512/ instead.
• /var/log/secure - Authentication log, contains records of connections that require authentication, such as VMware daemons and actions initiated by the xinetd daemon.
• /var/log/vmware/vpxa.log - Vpxa log, contains information on the agent that communicates with vCenter Server. Search the file date/time stamps to find the log file it is currently outputting to or open vpxa.log file which is linked to the current log file.

Virtual machine logs:

There is only one log file for virtual machines on a host and it is located in the working directory on the VMFS volume for the VM (i.e /vmfs/volumes/storage1/VM1/). The current log file is always vmware.log and older log files are incremented numerically (i.e. vmware-5.log).

vCenter Server logs:

The primary log file used by vCenter Server is the vpxd-#.log file (the # sign represents a number) which is located in the %allusersprofile%\Application Data\VMware\VMware VirtualCenter\Logs directory on the vCenter Servers version 2.5. The %allusersprofile% variable on most systems is the C:\Document and Settings\All Users directory. On older VirtualCenter 2.0 servers this file was located in the C:\Windows\Temp directory. New log files are automatically created when the logs grow to a certain size and the number in their filename is incremented. You can see which one is currently being used by sorting by modified date or by checking the vpxd-index file, which lists the number of the log file that is currently in use.

In addition to the vCenter Server log there are also logs for some of the other components, including Update Manager, Capacity Planner and Converter Enterprise. The logs are located in the \logs subdirectory under the various product directories which are located in %allusersprofile%\Application Data\VMware\. Here’s the list of log files that you will typically find on vCenter Servers:

• C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\Logs - vCenter Server main log files
• C:\Program Files\VMware\Infrastructure\VirtualCenter Server\tomcat\logs - Tomcat web server log files for the web access component of vCenter Server
• C:\Documents and Settings\All Users\Application Data\VMware\VMware Capacity Planner\Logs - Capacity Planner log files
• C:\Documents and Settings\All Users\Application Data\VMware\VMware Update Manager\Logs - Update Manager log files
• C:\Documents and Settings\All Users\Application Data\VMware\VMware Converter Enterprise\Logs - Converter Enterprise log files

The License Manager Server log file is typically named lmgrd.log file and is located in the Windows temp directory (i.e. C:\Windows\Temp). You can verify the location of this file by opening the VMware License Server Tools application and click on the Config Services tab and checking the path to the debug of file field.

I’d recommend printing out this blog post or bookmarking it so the next time you are troubleshooting a problem in your virtual environment you can quickly figure out which log to look at to help figure out the cause.