baber
Expert
Expert

How can see previous vmware logs

1- My esxi host has been restarted yesterday, Is that possible see the cause root of this problem in vmware logs ? Which Log can help me about this issue ?

2 - Actually I open syslog.log and vmkernel.log but the log is just for today and cannot see previous logs for example yesterday . How can see yesterday logs ?

BR

Please mark helpful or correct if my answer resolved your issue.
10 Replies
a_p_
Leadership
Leadership

On stand-alone hosts. the log files are unfortunately not persistent. In order to see older log entries, the host either needs to be managed by vCenter Server, or the host may be configured to send the logs to a syslog server.

In case you are using server hardware, an it was an unexpected restart, you may want to check whether the server itself offers a hardware integrated management log (e.g. iDRAC, iLO, ...).

André

0 Kudos
nachogonzalez
Expert
Expert

In most cases ESXI logs are not persistant

Do you have a scratch partition created?
VMware Knowledge Base

If you do, you can find over there the memory dumps and logs that might lead you to what caused the issue

Do you have a syslog collector working with you ESXi?

0 Kudos
baber
Expert
Expert

Actually my esxi host manage by vCenter

Please mark helpful or correct if my answer resolved your issue.
0 Kudos
baber
Expert
Expert

I don’t have scratch partition

would you say what is this? Actually this is a space that keep all log files ? All log files that write here are difference from vmkernel.log , syslog.log ,.....??

Please mark helpful or correct if my answer resolved your issue.
0 Kudos
nachogonzalez
Expert
Expert

ESXi logs are not persistant, since the esxi hypervisor runs in the memory pages, once you reboot the host, or have a hardware failure that make your hosts reboot, logs are gone.

If you have a scratch partition you gain the ability to persist log information across hardware failures or reboots.

0 Kudos
baber
Expert
Expert

If we create a scratch path for CoreDump can we say everytime after restart we saw a CoreDump in the scratch path means the problem is in esxi kernel otherwise the problem is for Hardware ?

Please mark helpful or correct if my answer resolved your issue.
0 Kudos
nachogonzalez
Expert
Expert

Not exactly.
If you create a scratch partition and also configure a syslog server what you'll do is give your logs persistance.
It will help you determine what is causing the issue

Also, in addition when an esxi host fails with a Purple screen of death it generates a vmkdump. that dump is generated on the scratch partition

0 Kudos
baber
Expert
Expert

Would you say me which log file exactly can help me about :

1- why my esxi host has been restarted ?

2 - Why my virtual machine has been restarted?

BR

Please mark helpful or correct if my answer resolved your issue.
0 Kudos
nachogonzalez
Expert
Expert

1. VMkernel.log
2. It's a combination of vmkernel.log, vmlogs (you can find those on vm folder on datastore) and guest os logs.

Most likely is the host was restarted and VMs were restarted at the same time it was due to vSphere HA

scott28tt
VMware Employee
VMware Employee

0 Kudos