ESXi records host activity in log files, using a syslog facility.

Component

Location

Purpose

VMkernel

/var/log/vmkernel.log

Records activities related to virtual machines and ESXi.

VMkernel warnings

/var/log/vmkwarning.log

Records activities related to virtual machines.

VMkernel summary

/var/log/vmksummary.log

Used to determine uptime and availability statistics for ESXi (comma separated).

ESXi host agent log

/var/log/hostd.log

Contains information about the agent that manages and configures the ESXi host and its virtual machines.

vCenter agent log

/var/log/vpxa.log

Contains information about the agent that communicates with vCenter Server (if the host is managed by vCenter Server).

Shell log

/var/log/shell.log

Contains a record of all commands typed into the ESXi Shell as well as shell events (for example, when the shell was enabled).

Authentication

/var/log/auth.log

Contains all events related to authentication for the local system.

System messages

/var/log/syslog.log

Contains all general log messages and can be used for troubleshooting. This information was formerly located in the messages log file.

Virtual machines

The same directory as the affected virtual machine's configuration files, named vmware.log and vmware*.log. For example, /vmfs/volumes/datastore/virtual machine/vwmare.log

Contains virtual machine power events, system failure information, tools status and activity, time sync, virtual hardware changes, vMotion migrations, machine clones, and so on.