- How to use vRealize Log Insight to retrieve logs from your Windows and Linux servers - Fri, Jul 23 2021
- Analyze basic log output from VMware vSphere 7 products - Wed, Jul 21 2021
- Analyze drmdump files with VMware DRS Dump Insight - Fri, Jul 9 2021
On a vCenter Server, the default logging level setting is Info. This is where errors, warnings, and informational level are logged. It is possible to change it and have more detailed logs.
You can use the vSphere Client to change the logging level by selecting the vCenter Server and then selecting Configure > Settings > General > Edit. Then set the logging settings to the appropriate level.
The logging settings include a drop-down menu where you can choose the log level. The choices include none, error, warning, info, verbose, or trivia.
However, VMware does not recommend increasing the log settings to trivia, which might cause performance degradation on vCenter Server. Only enable trivia or verbose logging for troubleshooting purposes.
vCenter Server logs ^
The main logs in a vCenter Server appliance are located in /var/log/vmware. The most important logs are in the vpxd subdirectory. Some other sibling subdirectories include vsan-health, vsphere-ui, and vpostgres.
The Management agent (hostd), VirtualCenter Agent Service (vpxa), and VirtualCenter (vpxd) logs are automatically rotated and maintained to manage their growth. If not, they will take up too much storage space.
On the other hand, the information in the logs can be lost if the logs are rotated too quickly; that's why the idea is to change to the trivia setting only during troubleshooting or when you want to send the logs to VMware.
What does it mean when logs are rotated too quickly? ^
The rotation of logs basically refers to the turnover of files, where the oldest files are deleted and replaced by new ones. For example, if you set the maximum number of log files to 10, the numbering restarts at 0 after every 10 log files.
You can adjust the log rotation using two advanced parameters:
- Syslog.global.defaultRotate—Maximum number of logs to keep when rotating logs. Syslog.global.defaultSize—Size of log (in KB) before log rotation is triggered.
These settings are based on a per-host level, so you have to go to the advanced system settings on your host.
Configure > System > Advanced system settings > Edit > filter for Syslog.
While there, you can also set up a global log directory, which can be located on the VMFS or NFS datastore.
You can also set up a remote syslog host via another advanced setting:
- Syslog.global.LogHost—Remote syslog host and port. The logs are sent to a remote host via this port. For example, if we want to forward to a server named syslogsvr01 using port 1514, we simply put ssl://syslogsvr-1:1514.
How can logs be controlled on a per-VM level? ^
You can change the number of logs for a single VM. Every time you power on a VM on your host, or resume, a log file is created.
VMware recommends saving ten-log files, each limited to no less than 2 MB. If you need logs for a longer time span, you can set vmx.log.keepOld to 20.
You can make this change via the vSphere web client. Select your VM, right-click, and select Edit Settings > VM Options > Advanced > Edit Configuration.
Vmx.log.keepOld—This is the setting to look for. Set this to the number you want.
You can also do this for all VMs on a particular host. In this case, you'll need to edit the /etc/vmware/config file where you'd add or edit a line like this:
vmx.log.keepOld = “10”
As you can see, we can pretty much configure the size of logs, their number, and rotation.
How do I upload my logs to VMware? ^
It is possible to export system logs from the vCenter Server and all its hosts. There is a procedure you can use, but begin by selecting the vCenter Server instead of a specific host.
In the wizard, you can select which hosts to include, and you can optionally select Include vCenter Server and vSphere UI Client Logs.
You can export a vCenter Server instance's support bundle by using the URL shown on the DCUI home screen (https://FQDN:443/appliance/support-bundle).
Final words ^
The best thing to do within the VMware environment is to set up a logging host or software. For example, vRealize Log Insight (vRLI), which is part of some VMware bundles, is perfect for the job.
As we saw, log creation happens at the host level, the vCenter Server level, or the VM level. Each part of the infrastructure basically generates logs; either they are stored for only a limited time, or their size is limited.
vSphere 7 logs, their creation, and their output are topics that you need to master to pass the VMware VCP-DCV certification exam. We hope that we've helped you to learn this chapter through our blog post.