How can I view VM Log files that are locked?

[slanger]

OK, dumb question: How can I view VM Log files that are locked?

I have an issue with a VM crashing and I want to view the current log file to diagnose. When I log into the ESX box with Veeam it wont allow me to view the file becasue it is locked by another process (its the current log file being written to), I have tried logging into the console and doing CAT and TAIL on the file but those gave me the same response of the file being locked by another process...

I know I can release the lock by shutting down the VM but that is not possible as it is a prod mail server and its running OK now.

Any ideas? TIA.

-Scott L.

[bradley4681]

are you logging into the console as root? can you do a cp and copy the file? usually you can still copy locked files.

Cheers,

Bradley Sessions

If you found this or other information useful, please consider awarding points for "Correct" or "Helpful".

[slanger]

Thanks for the answer Bradley but that did not work.Heres what happens:

root@esx4 BERT# ls BERT_1-flat.vmdk BERT-48de9275.hlog BERT-flat.vmdk BERT.vmdk BERT.vmx phd vmware-44.log vmware-46.log vmware-48.log BERT_1.vmdk BERT-48de9275.vswp BERT.nvram BERT.vmsd BERT.vmxf vmware-43.log vmware-45.log vmware-47.log vmware.log root@esx4 BERT# cp vmware-47.log vmware-47.log.COPY

cp: cannot open `vmware-47.log' for reading: Device or resource busy

root@esx4 BERT#

Anyone else have a suggestion? I'm going to try calling VMware to get an answer. I'll post it here if I do but I'm not optimistic. Seems like sometimes VMware support is OK and sometimes I feel like I know more about their product than they do. And I dont know very much. LOL.

[Texiwill · Accepted solution]

Hello,

vmware-47.log should be an unlocked file. I just copied several logfiles with no issues, so I believe you have a different problem going on. Specifically that the LUN the VM is on is locked still.

If you have vMotion, one solution is to vMotion the VM to another host. This should free up the lock. Another option is to use ;vmkfstools -L release /vmfs/devices/disks/....' from the CLI. 'man vmkfstools' for more assistance.

where ... is the disk in question on which the VM resides. Note the vmhba device to use whould be vmhba:C:T:L do not use the 4 item which is Partition. C => Controller, T => Target, L => LUN.

However, before I did either I would backup the VM.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education. CIO Virtualization Blog: http://www.cio.com/blog/index/topic/168354

As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

[slanger]

Amazing... vmotion of the server worked!! thanks. it starts a new log file and then the one I need is unlocked for viewing.

You are right about vmware-47 though, it should have been unlocked. Every other VM I look at uses the vmware.log as the current then files it as vmware-##.log when you reboot the machine or vmotion. I dont know why this particular server was using log 47 as the current. All the other logs including vmware.log were unlocked... weird.

On another note, I have been requesting my employer to buy your book for refernce for a few weeks now and we finaly got it though and I will have it in a few days. Looks good and I cant wait to dig in. Thanks for the help here and thanks in advance for the book help!!

-Scott L.

[fusebox]

This is similar to one of the threads to which I responded. This is basically file/device/resource being busy/accessed. You are not able to delete ,view or write or read the files(log,vmdk) of the vm in question as its busy or being accessed,inspite of the VM not being powered on or VM is deleted from the VC inventory list or unregistered from the esx host. Why dont you try to see the /var/log/vmkernel for an RCA instead of the log files in the vm files folder on the datastore?

Check this thread out. May be helpful and related to what you are asking.

http://communities.vmware.com/message/971031

[fusebox]

I got that book . Its an amazing one. Would highly recommend it. I practise the best practices mentioned in his book on all My projects. Infact, I make it a point.

Thanks Texiwill!!!

Do let us know is you have any other book coming up in future. Put Me in the waiting list

[fusebox]

Texiwill,

The vmotion workaround you gave was really novel. But, I have doubt. What if one faces the issue in prod and they cant afford to vmotion or dont want to vmotion the vm to another esx just for the sake of releasing the lock on the log. Isnt killing the stale pid accessing those files a more easier or valid approach?

[bradley4681]

I ran into this issue at support when I worked for VMware the solution then was either VMotion or reboot.

Cheers,

Bradley Sessions

If you found this or other information useful, please consider awarding points for "Correct" or "Helpful".

[rod955i]

The vmware.log file is locked if you try and view or copy it by accessing an ESX host which is NOT hosting the VM.

I.E you browse the datastore for the logfile using winscp or similar when logged into an ESX host which does not host the VM you want to view the log file of.

Log into the host which hosts the VM and then you can view or download the current running vmware.log file.