Objective 5.3 Topics:
- Generate vSphere Log Bundles
- Configure and Test Centralized Logging
- Analyze Log Entries to Obtain Configuration Information
- Analyze Log Entries to Identify and Resolve Issues
- Configure Logging Levels for vSphere
Generate vSphere Log Bundles
vCenter Server Appliance 6.0 logs are located in the /var/log/vmware folder.
We can review these logs several different ways.
- From the DCUI of the ESXi Host
2. Web Browser
3. C# Client (Fat Client)
4. vCenter Web Client
Auditing ESXi Shell Logins and Commands
We can go to the logs to see which user and client issued requests.
We can do this a bunch of different ways but I’ll do it from the command line directly into the host.
Open SSH, connect to the host and navigate to the directory where the logs reside /var/log/
We can read the logs of interest. In this case we’ll read the auth.log and shell.log to see what’s going on.
Auth.log – Looks like someone connected recently.
Shell.log – Here we can see what commands were issued and when.
Generate vSphere Log Bundles
From the C# Client:
From the Web Client:
From the Web Client instead vCenter.
Collect Logs Using the VM-Support Command in ESXi
This will take a minute. Once it’s completed we’ll then transfer them to a datastore so we can download them. Alternatively we could always use WinSCP to grab them. I guess it’s a matter of preference or availability.
Done and lists the location of the logs.
Move the logs to a datastore for download and send to VMware or to analyze offline.
There are tons of ways to download support bundles. These are just a few ways. I don’t want to go into them all.
Configure and Test Centralized Logging
ESXi 6.0 hosts run a syslog service (vmsyslogd) that provides a standard mechanism for logging messages from the VMkernel and other system components. By default in ESXi, these logs are placed on a local scratch volume or a ramdisk. To preserve the logs further, ESXi can be configured to place these logs to an alternate storage location on disk and to send the logs across the network to a syslog server.
There are 5 configurable options we can set:
Syslog.Global.logDir – A location on a local or remote datastore and path where logs are saved to.
Example: [Datastore Name]/Directory/Filename
Syslog.global.logHost – A comma-delimited list of remote servers where logs are sent using the syslog protocol. If the logHost field is blank, no logs are forwarded. Include the protocol and port, similar to tcp://hostname:514 or udp://hostname:514
Syslog.global.logDirUnique – True/False. Set to true will create individual directories per host (w/ host name) in the specified folder.
Syslog.global.defaultRotate – Max number of logs to keep locally. Does not effect the remote log server retention.
Syslog.global.defaultSize – Max size (in KB) of each log file before it is rotated or rolled over.
In the Web Client:
In the ESXi CLI
Example to configure the settings:
esxcli system syslog config set –logdir= /path/to/vmfs/directory/ –loghost= RemoteHostname –logdir-unique=true|false –default-rotate= NNN –default-size= NNN
Configuring Local/remote Logging with Host Profiles
Redirect vCenter Appliance Sys Logs to another location
Change Global Log Level (Host Agent)
VPXA Logging Level
vCenter Logging Level