ESX logs

[VCPGuru]

hi all

I read the VMware Security Hardening documentation and they told, that you should controll regulary all your ESX logs. I now want to setup, that all the ESX logs came to an central syslog server.

Which logs are important (only "error" and "warnings" logs)? Which logs are you controlling regulary? Are there some best practices?

[kooltechies]

Hi,

Ideally error and warnings should be part of monitoring , but if you are looking for specific files I would say these are some important ones.

/var/log/vmkernel

/var/log/vmkwarning

/var/log/vmware/hostd.log

/var/log/vmware/esxupdate.log

/var/log/messages

/var/log/vmware/vpx/vpxa.log

Thanks,

Samir

P.S : If you think that the answer is helpful please consider rewarding points.

[gary1012]

I'd add /var/log/secure to that list.

[Texiwill · Accepted solution]

Hello,

I would add all logs to this list actually, specifically once that talk through syslog, which is the one that you can redirect. Also, setup SUDO to use syslog and you will have a better set of items.

All the log files mentioned actually use syslog so you are safe there.

Best regards,
Edward L. Haletky
VMware Communities User Moderator
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
Blue Gears and SearchVMware Pro Blogs -- Top Virtualization Security Links -- Virtualization Security Round Table Podcast