Logging in vSphere 5.0
Logging in vSphere 5.0 has been significantly enhanced. You now have fine-grained control over system logs, the location where logs are sent, and, for each log, default size and rotation policy. You can set up logging with the vSphere Client or with the esxcli system syslog command. You can also set up logging behavior for a host by using the Host Profiles interface in the vSphere Client and can then import that host profile into other hosts.
Remote Logging Setup in ESXi
You can move most ESXi logging information off the host. Collecting data to a central location is especially useful for hosts provisioned with Auto Deploy. You can perform these tasks:
Using ESXCLI for Syslog Configuration
The esxcli system syslog command allows you to configure the logging behavior of your ESXi system. You can perform the same customizations with the vSphere client, as discussed in the vCenter Server and Host Management documentation. The command has the following options:
--logdir=<path> – Save logs to a given path.
--loghost=<host> – Send logs to a given host (see discussion on loghost format below)
--logdir-unique=<true|false> – Specify whether the log should go to a unique subdirectory of the directory specified in logdir.
--default-rotate=<int> – Default number of log rotations to keep
--default-size=<int> – Size before rotating logs, in kilobytes.
--id=<str> – ID of the logger to configure (required)
--reset=<str> – Reset values to default
--rotate=<long> – Number of rotated logs to keep for a specific logger (requires --id)
--size=<long> – Set size of logs before rotation for a specific logger, in kilobytes (requires --id)
esxcli system syslog Examples
The following workflow illustrates how you might use esxcli system syslog for log configuration.
esxcli system syslog config get
Default Rotation Size: 1024
Default Rotations: 8
Log Output: /scratch/log
Logto Unique Subdirectory: false
Remote Host: <none>
esxcli system syslog config set --default-rotate=20
esxcli system syslog config logger --id=vmkernel --size=2048 --rotate=10
Send logs to remote host myhost.mycompany.com. The logs will use the default UDP port, 514.
esxcli system syslog config set --loghost='myhost.mycompany.com'
Send logs /scratch/mylogs on the remote host myhost.mycompany.com using TCP/IP port 1514.
esxcli system syslog config set --loghost='tcp://myhost.mycompany.com:1514' --logdir='/scratch/mylogs'
esxcli system syslog mark --message="this is a message!"
esxcli system syslog reload
Viewing Logs in the ESXi Shell
In the ESX 4.x shell, the location for logs is /var/log. In the ESXi Shell, you can also find all current logs in the /var/log directory. Some of the logs are symbolic links to the /var/run/log directory.
Most logs are at top level and not inside a directory under /var/run/log. Available logs depend on which plugins are installed and what other changes might have been made to the system. The following table lists some frequently used logs in the ESXi Shell.
Core Dump Setup for ESXi
A core dump can be used to determine the reason for system failure. With ESX, the core dump was placed on the local disk in many cases. With ESXi, you have two options for managing core dumps.
Create a diagnostic partition on SAN storage. Each host must have a diagnostic partition of 100MB. If multiple hosts share a SAN, configure a diagnostic partition with 100MB for each host.
Install and configure ESXi Dump Collector. New in ESXi, the Dump Collector service allows you to send core dumps to a network server. ESXi Dump Collector is especially useful for determining reasons for failure of ESXi hosts provisioned with Auto Deploy.
You can use esxcli system coredump to configure a remote or local core dump partition. You can also use the Network Configuration host profile to set up hosts to use ESXi Dump Collector. For either case, you can apply the host profile of a host that uses ESXi Dump Collector to other hosts.
To use ESXi Dump Collector
ESXi Dump Collector is one of the services you can install using the vCenter Server system installation package. See vSphere Installation and Setup.
If you use the vCenter Server on Linux appliance, ESXi Dump Collector is preinstalled.
Two namespaces are supported inside this namespace.
get: Retrieve one of the dump partition values.
list: List all partitions on the system that have a partition type matching the VMware Core partition type.
set: Set the core dump partition for this system.
get: Get the currently configure parameters for ESXi Dump Collector (network coredump), if enabled.
set: Set the parameters used for network coredump.
The following example sets up the network and enables ESXi Dump Collector with the ESXCLI vCLI command.
esxcli --server MyESXiHost system coredump network set --interface-name vmk0 --server-ipv4 10XX... --port 6500
esxcli --server MyESXiHost system coredump network get --enable true --type network
You are prompted for a user name and password for the ESXi host.