Logging in vSphere 5.0 and Later

Logging in vSphere 5.0 has been significantly enhanced. You now have fine-grained control over system logs, over the location where logs are sent, and, for each log, over default size and rotation policy. You can set up logging with the vSphere Client or with the esxcli system syslog command. You can also set up logging behavior for a host by using the Host Profiles interface in the vSphere Client and can then import that host profile into other hosts.

Remote Logging Setup in ESXi

You can move most ESXi logging information off the host. Collecting data to a central location is especially useful for hosts provisioned with Auto Deploy. You can perform these tasks:

■	Set up NTP on the ESXi hosts you are monitoring and on the systems that host the logging services or store the logs. You can use the vSphere Client or the vicfg-ntp vCLI command to set up NTP.

■	Configure syslog to save logs to a remote host. You can send logs to a specific directory, and configure subloggers. See Using ESXCLI for Syslog Configuration.

■	vCenter Server and ESXi have SNMP agents. You can set up the vCenter Server SNMP agent with the vSphere Client. You can set up the ESXi SNMP agent with the vSphere Client or the esxcli system snmp commands. See vSphere Command-Line Interface Solutions and Examples.

■	Listen for CIM indications.

Using ESXCLI for Syslog Configuration

The esxcli system syslog command allows you to configure the logging behavior of your ESXi system. You can perform the same customizations with the vSphere Client or, for managed hosts, with the vSphere Web Client. See the vCenter Server and Host Management documentation. The command has the following options:

esxcli syslog Options 

Option	Description
mark	Mark all logs with the specified string.
reload	Reload the configuration and update any configuration values that have changed.
config get	Retrieve the current configuration.
config set	Set the configuration. Use one of the following options. ■ --logdir=<path> – Save logs to a given path. ■ --loghost=<host> – Send logs to a given host (see discussion on loghost format below) ■ --logdir-unique=<true|false> – Specify whether the log should go to a unique subdirectory of the directory specified in logdir. ■ --default-rotate=<int> – Default number of log rotations to keep ■ --default-size=<int> – Size before rotating logs, in kilobytes.
config logger list	Show currently configured sub-loggers.
config logger set	Set configuration options for a specific sublogger. Use one of the following options: ■ --id=<str> – ID of the logger to configure (required) ■ --reset=<str> – Reset values to default ■ --rotate=<long> – Number of rotated logs to keep for a specific logger (requires --id) ■ --size=<long> – Set size of logs before rotation for a specific logger, in kilobytes (requires --id)

esxcli system syslog Examples

The following workflow illustrates how you might use esxcli system syslog for log configuration.

1	Show configuration options.

esxcli system syslog config get

Default Rotation Size: 1024

Default Rotations: 8

Log Output: /scratch/log

Logto Unique Subdirectory: false

Remote Host: <none>

2	Set all logs to keep twenty versions, then start overwriting the oldest log.

esxcli system syslog config set --default-rotate=20

3	Set the rotation policy for VMkernel logs to 10 rotations, rotating at 2MB.

esxcli system syslog config logger --id=vmkernel --size=2048 --rotate=10

4	Send logs to remote host myhost.mycompany.com. The logs will use the default UDP port, 514.

esxcli system syslog config set --loghost='myhost.mycompany.com'

5	Send logs /scratch/mylogs on the remote host myhost.mycompany.com using TCP/IP port 1514.

esxcli system syslog config set --loghost='tcp://myhost.mycompany.com:1514' --logdir='/scratch/mylogs'

6	Send a log message into all logs simultaneously.

esxcli system syslog mark --message="this is a message!"

7	Reload the syslog daemon and apply configuration changes.

esxcli system syslog reload

Viewing Logs in the ESXi Shell

In the ESX 4.x shell, the location for logs is /var/log. In the ESXi Shell, you can also find all current logs in the /var/log directory. Some of the logs are symbolic links to the /var/run/log directory.

Most logs are at top level and not inside a directory under /var/run/log. Available logs depend on which plugins are installed and what other changes might have been made to the system. The following table lists some frequently used logs in the ESXi Shell.

ESX 4.x shell	ESXi 5.0 and later shell	Description
/var/log/vmware/hostd.log	/var/log/hostd.log	Log for the host daemon.
/var/log/vmkwarning	/var/log/vmkwarning.log
/var/log/vmksummary	/var/log/vmksummary.log
/var/log/messages	/var/log/vmkernel.log	VMkernel warnings and VMkernel events.
/var/log/vmware/vpx/vpxa.log	/var/log/vpxa.log	vCenter Server agent log.

Core Dump Setup for ESXi

A core dump can be used to determine the reason for system failure. You have two options for managing core dumps.

■	Create a diagnostic partition on SAN storage. Each host must have a diagnostic partition of 100MB. If multiple hosts share a SAN, configure a diagnostic partition with 100MB for each host.

■

Configure ESXi Dump Collector. The ESXi Dump Collector service allows you to send core dumps to a network server. ESXi Dump Collector is especially useful for determining reasons for failure of ESXi hosts provisioned with Auto Deploy. In vSphere 6.0, ESXi is included with each embedded deployment, each management node, and each vCenter Server appliance.

You can use esxcli system coredump to configure a remote or local core dump partition. You can also use the Network Configuration host profile to set up hosts to use ESXi Dump Collector. For either case, you can apply the host profile of a host that uses ESXi Dump Collector to other hosts.

To use ESXi Dump Collector

1	Set up ESXi systems that should use ESXi Dump Collector with commands in the esxcli system coredump namespace.

Two namespaces are supported inside this namespace.

■	esxcli system coredump partition

■	get: Retrieve one of the dump partition values.

■	list: List all partitions on the system that have a partition type matching the VMware Core partition type.

■	set: Set the core dump partition for this system.

■	esxcli system coredump network

■	get: Get the currently configure parameters for ESXi Dump Collector (network coredump), if enabled.

■	set: Set the parameters used for network coredump.

The following example sets up the network and enables ESXi Dump Collector with the ESXCLI vCLI command.

esxcli --server MyESXiHost system coredump network set --interface-name vmk0 --server-ipv4 10XX... --port 6500

esxcli --server MyESXiHost system coredump network get --enable true --type network

You are prompted for a user name and password for the ESXi host.

For additional details, see the vSphere Installation and Setup documentation in the vSphere 6 documentation center.