How can see previous vmware logs

[baber]

1- My esxi host has been restarted yesterday, Is that possible see the cause root of this problem in vmware logs ? Which Log can help me about this issue ?

2 - Actually I open syslog.log and vmkernel.log but the log is just for today and cannot see previous logs for example yesterday . How can see yesterday logs ?

BR

[a_p_]

On stand-alone hosts. the log files are unfortunately not persistent. In order to see older log entries, the host either needs to be managed by vCenter Server, or the host may be configured to send the logs to a syslog server.

In case you are using server hardware, an it was an unexpected restart, you may want to check whether the server itself offers a hardware integrated management log (e.g. iDRAC, iLO, ...).

André

[nachogonzalez]

In most cases ESXI logs are not persistant

Do you have a scratch partition created?
VMware Knowledge Base

If you do, you can find over there the memory dumps and logs that might lead you to what caused the issue

Do you have a syslog collector working with you ESXi?

[baber]

Actually my esxi host manage by vCenter

[baber]

I don’t have scratch partition

would you say what is this? Actually this is a space that keep all log files ? All log files that write here are difference from vmkernel.log , syslog.log ,.....??

[nachogonzalez]

ESXi logs are not persistant, since the esxi hypervisor runs in the memory pages, once you reboot the host, or have a hardware failure that make your hosts reboot, logs are gone.

If you have a scratch partition you gain the ability to persist log information across hardware failures or reboots.

[baber]

If we create a scratch path for CoreDump can we say everytime after restart we saw a CoreDump in the scratch path means the problem is in esxi kernel otherwise the problem is for Hardware ?

[nachogonzalez]

Not exactly.
If you create a scratch partition and also configure a syslog server what you'll do is give your logs persistance.
It will help you determine what is causing the issue

Also, in addition when an esxi host fails with a Purple screen of death it generates a vmkdump. that dump is generated on the scratch partition

[baber]

Would you say me which log file exactly can help me about :

1- why my esxi host has been restarted ?

2 - Why my virtual machine has been restarted?

BR

[nachogonzalez]

1. VMkernel.log
2. It's a combination of vmkernel.log, vmlogs (you can find those on vm folder on datastore) and guest os logs.

Most likely is the host was restarted and VMs were restarted at the same time it was due to vSphere HA

[scott28tt]

A couple of good references for you:

ESXi Log File Locations

VMware Knowledge Base