What's the best way of gathering logs to send to Vmware

[falcone1]

I have ESXi 4.1

I recently sent logs to support, on their request, after we had a host freeze on us.

They responded back that the logs didn't capture anything because a reboot refreshes the logs and only a syslog would be able to provide clues before a crash.

Is this correct because it's strange that logs would be destroyed after a reboot.

The syslog provides a challenge because we can't control the severity level on the host so we're dumped with a lot of useless information.

We need logs to find out why our hosts are crashing and requiring us to reboot.  In one occasion, we didn't get the vms to vmotion to another host.

On another occasion we did, but the host was not responsive until we restarted it.

What's the best way to collect logs so we can send to vmware for analysis?

Thanks,

falcone

[mcowger · Accepted solution]

On ESXi, if you didn't create a large scratch partition, yes the logs would be lost on reboot.

Syslog is the right way to capture this. 

[cblomart]

As mcowger indicates... there's two ways to persist logs that i know of:

- send logs to a datastore:

here an extract of our kickstart for esxi that logs to a localdatastore ($locadatastore and $esxname are replaced with proper names).

[...]

mkdir /vmfs/volumes/$localdatastore/logs
vim-cmd hostsvc/advopt/update Syslog.Local.DatastorePath string "[$localdatastore] /logs/$esxname.log"

[...]

- send logs to a syslog collector:

as well an extract of our kickstart ( ###.###.###.### is the ip of the remote syslog server).

[...]

# configure remote syslog
vim-cmd hostsvc/advopt/update Syslog.Remote.Hostname string ###.###.###.###
vim-cmd hostsvc/advopt/update Syslog.Remote.Port int 514

[...]

The remote syslog server can be anything understanding syslog (linux/unix server or syslog collector provided by vCenter with vSphere 5).

I forgot to indicate that as far as i know, the best practice is to use syslog

[BharatR]

Hi,

What's the best way to collect logs so we can send to vmware for analysis?

Here is the article for Collecting the Logs

http://kb.vmware.com/kb/653

[cblomart]

BharatR

This doesn't keep logs after reboot... It's the way to get current logs via vcenter.