If you're running just a vSphere, and ESXi, the logging will be concentrated only from those two products. VMware has, however, a large portfolio of products, each of which has its own logging. It is probably best to send logs from all VMware products to a remote logging server that can ingest the logs and present you with a graphical UI that also allows advanced search capabilities for specific issues.

On a vCenter Server, the default logging level setting is Info. This is where errors, warnings, and informational level are logged. It is possible to change it and have more detailed logs.

You can use the vSphere Client to change the logging level by selecting the vCenter Server and then selecting Configure > Settings > General > Edit. Then set the logging settings to the appropriate level.

vCenter server logs settings

vCenter server logs settings

The logging settings include a drop-down menu where you can choose the log level. The choices include none, error, warning, info, verbose, or trivia.

However, VMware does not recommend increasing the log settings to trivia, which might cause performance degradation on vCenter Server. Only enable trivia or verbose logging for troubleshooting purposes.

Edit vCenter Server log settings

Edit vCenter Server log settings

vCenter Server logs ^

The main logs in a vCenter Server appliance are located in /var/log/vmware. The most important logs are in the vpxd subdirectory. Some other sibling subdirectories include vsan-health, vsphere-ui, and vpostgres.

The Management agent (hostd), VirtualCenter Agent Service (vpxa), and VirtualCenter (vpxd) logs are automatically rotated and maintained to manage their growth. If not, they will take up too much storage space.

On the other hand, the information in the logs can be lost if the logs are rotated too quickly; that's why the idea is to change to the trivia setting only during troubleshooting or when you want to send the logs to VMware.

What does it mean when logs are rotated too quickly? ^

The rotation of logs basically refers to the turnover of files, where the oldest files are deleted and replaced by new ones. For example, if you set the maximum number of log files to 10, the numbering restarts at 0 after every 10 log files.

You can adjust the log rotation using two advanced parameters:

  • Syslog.global.defaultRotate—Maximum number of logs to keep when rotating logs. Syslog.global.defaultSize—Size of log (in KB) before log rotation is triggered.

These settings are based on a per-host level, so you have to go to the advanced system settings on your host.

Configure > System > Advanced system settings > Edit > filter for Syslog.

Configuring syslog on ESXi 7 hosts

Configuring syslog on ESXi 7 hosts

While there, you can also set up a global log directory, which can be located on the VMFS or NFS datastore.

You can also set up a remote syslog host via another advanced setting:

  • Syslog.global.LogHost—Remote syslog host and port. The logs are sent to a remote host via this port. For example, if we want to forward to a server named syslogsvr01 using port 1514, we simply put ssl://syslogsvr-1:1514.

How can logs be controlled on a per-VM level? ^

You can change the number of logs for a single VM. Every time you power on a VM on your host, or resume, a log file is created.

VMware recommends saving ten-log files, each limited to no less than 2 MB. If you need logs for a longer time span, you can set vmx.log.keepOld to 20.

You can make this change via the vSphere web client. Select your VM, right-click, and select Edit Settings > VM Options > Advanced > Edit Configuration.

Vmx.log.keepOld—This is the setting to look for. Set this to the number you want.

You can also do this for all VMs on a particular host. In this case, you'll need to edit the /etc/vmware/config file where you'd add or edit a line like this:

vmx.log.keepOld = “10”

As you can see, we can pretty much configure the size of logs, their number, and rotation.

How do I upload my logs to VMware? ^

It is possible to export system logs from the vCenter Server and all its hosts. There is a procedure you can use, but begin by selecting the vCenter Server instead of a specific host.

In the wizard, you can select which hosts to include, and you can optionally select Include vCenter Server and vSphere UI Client Logs.

You can export a vCenter Server instance's support bundle by using the URL shown on the DCUI home screen (https://FQDN:443/appliance/support-bundle).

Create vCenter Server appliance support bundle

Create vCenter Server appliance support bundle

Final words ^

The best thing to do within the VMware environment is to set up a logging host or software. For example, vRealize Log Insight (vRLI), which is part of some VMware bundles, is perfect for the job.

As we saw, log creation happens at the host level, the vCenter Server level, or the VM level. Each part of the infrastructure basically generates logs; either they are stored for only a limited time, or their size is limited.

vSphere 7 logs, their creation, and their output are topics that you need to master to pass the VMware VCP-DCV certification exam. We hope that we've helped you to learn this chapter through our blog post.


Leave a reply

Please enclose code in pre tags

Your email address will not be published. Required fields are marked *


© 4sysops 2006 - 2021


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account