Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been working on ESX3 and 3.5 but never came across these logs. Now I want to know how to read such logs and what are the different logs I can see from /var/logs

I tried to read "messages" logs for service console, but could not recollect much. Also at what point these different logs are useful for common problems on ESX where we can refer these logs.

Please let me know...

share|improve this question

There are many different logs in different places.

Vmkernel – /var/log/vmkernel – records activities related to the virtual machines and ESX server. • Vmkernel Warnings – /var/log/vmkwarning – This log is a copy of everything marked as a warning or higher severity from vmkernel log. It is much easier to look through this for warnings and errors, instead of filtering through the full information in the vmkernel logs.

• Vmkernel Summary – /var/log/vmksummary – Used to determine uptime and availability statistics for ESX Server; human-readable summary found in /var/log/vmksummary.txt

• ESX Server host agent log – /var/log/vmware/hostd.log – Contains information on the agent that manages and configures the ESX Server host and its virtual machines (Search the file date/time stamps to find the log file it is currently outputting to).

• Service Console – /var/log/messages – This log is the log from the Linux kernel (service console), which is generally only potentially useful in the case of a host hang, crash, authentication issue, or 3rd party app acting up. This log has NOTHING to do with virtual machines. The SERVICE CONSOLE (red hat kernel) has NO awareness of the VMs (worlds) running on the VMKERNEL.

• Web Access – /var/log/vmware/webAccess – Records information on Web-based access to ESX Server.

• Authentication log – /var/log/secure – Contains records of connections that require authentication, such as VMware daemons and actions initiated by the xinetd daemon.

• VirtualCenter agent – /var/log/vmware/vpx – Contains information on the agent that communicates with VirtualCenter.

• Virtual Machines – The same directory as the affected virtual machine’s configuration files; named vmware.log – Contain information when a virtual machine crashes or ends abnormally.

Hope these help

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.