VCAP6: 5.3 - Manage and Analyze vSphere Log Files

Objective 5.3 Topics:

Generate vSphere Log Bundles
Configure and Test Centralized Logging
Analyze Log Entries to Obtain Configuration Information
Analyze Log Entries to Identify and Resolve Issues
Configure Logging Levels for vSphere

Generate vSphere Log Bundles

vCenter Server Appliance 6.0 logs are located in the /var/log/vmware folder.

We can review these logs several different ways.

From the DCUI of the ESXi Host

2. Web Browser

https://esxi_fqdn_or_ip/host

3. C# Client (Fat Client)

4. vCenter Web Client

Auditing ESXi Shell Logins and Commands

We can go to the logs to see which user and client issued requests.

We can do this a bunch of different ways but I’ll do it from the command line directly into the host.

Open SSH, connect to the host and navigate to the directory where the logs reside /var/log/

We can read the logs of interest. In this case we’ll read the auth.log and shell.log to see what’s going on.

Auth.log – Looks like someone connected recently.

Shell.log – Here we can see what commands were issued and when.

Generate vSphere Log Bundles

From the C# Client:

From the Web Client:

And download.

From the Web Client instead vCenter.

Collect Logs Using the VM-Support Command in ESXi

This will take a minute. Once it’s completed we’ll then transfer them to a datastore so we can download them. Alternatively we could always use WinSCP to grab them. I guess it’s a matter of preference or availability.

Done and lists the location of the logs.

Move the logs to a datastore for download and send to VMware or to analyze offline.

There are tons of ways to download support bundles. These are just a few ways. I don’t want to go into them all.

Configure and Test Centralized Logging

ESXi 6.0 hosts run a syslog service (vmsyslogd) that provides a standard mechanism for logging messages from the VMkernel and other system components. By default in ESXi, these logs are placed on a local scratch volume or a ramdisk. To preserve the logs further, ESXi can be configured to place these logs to an alternate storage location on disk and to send the logs across the network to a syslog server.

There are 5 configurable options we can set:

Syslog.Global.logDir – A location on a local or remote datastore and path where logs are saved to.

Example: [Datastore Name]/Directory/Filename

Syslog.global.logHost – A comma-delimited list of remote servers where logs are sent using the syslog protocol. If the logHost field is blank, no logs are forwarded. Include the protocol and port, similar to tcp://hostname:514 or udp://hostname:514

Syslog.global.logDirUnique – True/False. Set to true will create individual directories per host (w/ host name) in the specified folder.

Syslog.global.defaultRotate – Max number of logs to keep locally. Does not effect the remote log server retention.

Syslog.global.defaultSize – Max size (in KB) of each log file before it is rotated or rolled over.

In the Web Client:

In the ESXi CLI

Example to configure the settings:

esxcli system syslog config set –logdir= /path/to/vmfs/directory/ –loghost= RemoteHostname –logdir-unique=true|false –default-rotate= NNN –default-size= NNN

Configuring Local/remote Logging with Host Profiles