ralish
Enthusiast
Enthusiast

ESXi logging limitations?

Jump to solution

Hello,

I was wondering if someone could confirm if ESXi has any specific limitations as to what logfiles can be collected versus ESX? I ask, as I have setup logging on my ESXi server, however, I appear to only be able to retrieve the "messages" and "host agent" log files. The output of "vilogger list" is below:

$ vilogger list

ESX Server: <removed>

Log Status CollectionPeriod NumRotation MaxFileSize Location (Seconds) (MegaBytes)

hostd Enabled 60 5 5 /var/log/vmware/<removed>/hostd.log

messages Enabled 60 5 5 /var/log/vmware/<removed>/messages.log

I would be particularly interested in collecting the vmkernel related log files, according to the VIMA documentation: vmkernel/vmksummary/vmkwarning. Is this possible? If so, how?

Thanks for any help!

Tags (3)
0 Kudos
1 Solution

Accepted Solutions
Charu
Enthusiast
Enthusiast

The 'messages' log file on ESXi contains the same information that is in the vmkernel and vmkwarnings files on regular ESX. The vmksummary log file does not exist on ESXi. The vpxa (VC agent) log file is also accessible via syslog, once the host has joined to a VC instance. As you observed, the hostd log file is available too. Currently, other than these three, no other log files are exposed to syslog on ESXi.

View solution in original post

0 Kudos
7 Replies
tren
Contributor
Contributor

As I know, there are only 3 logs for ESXi system (DCUI->View System Logs):

<1> Messages

<2> Config

<3> Management Agent (hostd)

So, VIMA cannot collect vmkernel/vmksummary/vmkwarning logs because these logs are not generated by ESXi.

ralish
Enthusiast
Enthusiast

Oh, they're definitely generated in some form, whether they are logged to disk as a file I'm not certain.

As an example, ALT+F12 on an ESXi box and you can see the vmkernel log; I assume this corresponds to the /var/log/vmkernel log referenced in the VIMA documentation.

Another example, ALT+F11 on an ESXi box and you can see what appears to be vmkernel related warnings; I assume this corresponds to the /var/log/vmkwarning log referenced in the VIMA documentation.

I'm asking all of this as the VIMA documentation appears to suggest that these logs can be recorded by VIMA, if you download the VIMA guide, check page 36 for a list of available logs. In summary: messages, vmkernel, vmksummary, vmkwarning, host agent, virtualcenter agent. I can only seem to record the messages and host agent logs.

I'm interested to know if these logs are only supported under ESX (for recording by VIMA)? Can someone confirm what logs are available to the vilogger daemon when connected to an ESX host? I don't have access to such a host, just my ESXi box.

Or is there something else I'm missing, VIMA documentation inaccurate? Some additional steps or configuration tweaking to enable recording these logs?

This is mostly just an educational exercise, as the vmkernel logs can provide a valuable and very indepth insight into the goings on of the system at the hypervisor level (duh), but I imagine some of the data recorded could potentially be extremely valuable in troubleshooting. If it can be accessed via VIMA, this is far more convenient than having to physically move to the ESXi host or enable the SSH daemon on the actual ESXi box, which is both unsupported and a potential security issue.

0 Kudos
Charu
Enthusiast
Enthusiast

The 'messages' log file on ESXi contains the same information that is in the vmkernel and vmkwarnings files on regular ESX. The vmksummary log file does not exist on ESXi. The vpxa (VC agent) log file is also accessible via syslog, once the host has joined to a VC instance. As you observed, the hostd log file is available too. Currently, other than these three, no other log files are exposed to syslog on ESXi.

0 Kudos
ralish
Enthusiast
Enthusiast

Thank you very much for the clarification, this cleans up the confusion for me entirely.

It might be worthwhile to amend the VIMA documentation to better reflect what exactly can be logged in ESX versus ESXi, as currently, it just provides a list of potential log files with no explanation as to expected availability.

0 Kudos
aenagy
Hot Shot
Hot Shot

Charu:

That's not what I am seeing on my dev ESXi 4 (build 219382) vs. vMA/vilogger 4. The output from syslog seems to be missing entries in 'vpxa.log'. This host is managed by vCenter and both have real (not demo) licenses.

Is this normal?

Is there something that can be done to fix it?

Thanks.

0 Kudos
aenagy
Hot Shot
Hot Shot

I opened a SR with VMware technical support and found out that there is a configuration change to 'vpxa.cfg' for ESXi 4 that will send entries from vpxa.log, in addition to the entries from vmkernel and hostd. I asked if this information would be published in a public KB article and the answer I got was:

Regarding the kb article it will be made public in future as currently it is being monitored by engineering.

0 Kudos
ferdis
Hot Shot
Hot Shot

Hi,

what is result of this discussion? Im really interested in this!

0 Kudos