As you work through an incident with ESXi, there's a good chance VMware support will request your vSphere log files....
You can always retrieve configuration information regarding your ESXI hosts or log files in your vCenter Servers, manually. However, VMware has a semiautomated offering that collects all of the diagnostic information you need from your servers.
To get the vSphere log files and configuration information, you can directly access your hosts through either the operating system -- Secure Shell, local shell or local desktop -- the vSphere Client (for ESXi) or through the vSphere Web Client (for vCenter).
This article will look at the individual server options as well as how to collect all of the diagnostic information from a central location.
Collecting vSphere log files
One of the simpler options is through the vSphere Client. If you choose Monitor, there will be five different tabs to choose from. As you can see in Figure A, all vSphere log files are available from the monitor menu option in the Logs tab. You can find the proper log by sorting either the log name or its description. Above the list of logs is the option Generate support bundle. This option will take a few minutes to collect all the data from your ESXi host. Once complete, you can download the log as a file. This can be useful if there is an incident and you need to send information to VMware support.
You can also use a command to retrieve the diagnostic bundle from your ESXi host. Run the vm-support command on the local shell or on the shell via secure shell. This creates the support bundle in the /var/tmp folder on the ESXi host. Storing on a shared location can be a more convenient option because you can copy the data more easily. You can copy the data with the –w parameter, which changes the working directory for the command and provides a path to the shared data store.
The last option for collecting individual support bundles is to access the host via a browser using this address: https://esxihost/cgi-bin/vm-support.cgi. As you can see in Figure B, after visiting this URL -- and providing the proper root credentials -- you can download the support bundle.
Collecting with the vSphere Web Client
The three methods mentioned above are viable options if you need the diagnostic information from individual servers and you don't have access to vCenter. But when you do have access to vCenter with the vSphere Web Client, it's much easier to collect the diagnostic information from here.
In the vSphere Web Client, select your vCenter server object in the inventory, and from the Actions drop down, select Export System Logs.
From there, select which ESXi hosts you want to export the logs from, and at the bottom of the dialog box you can also select to export the support bundle from vCenter and the Web Client.
After selecting the ESXi hosts you're looking for, the final step is to select which components to include in the diagnostic bundle. These components include IntegrityChecks, VirtualMachines, Storage, Network, FaultTolerance, ActiveDirectory and more. You also have the option to gather performance data between a certain range as well as the ability to add a password for encrypted core dumps.
If you need to submit the log files to VMware support because of an incident, you can upload the files directly by going to Administration > Support > Upload File to Service Request.
Now you know how to retrieve vSphere log files and diagnostic information. However, finding the specific log can be troublesome. VMware constructed a list of all log locations for VMware products, available on its website. In case of a problem, this list can help you find the log you need -- especially if there is an issue retrieving it via one of the methods we talked about above.
How to store ESXi syslog events on a remote Linux server
Make VM troubleshooting a painless process
How Log Insight got its start with VMware
Dig Deeper on VMware basics
Related Q&A from Rob Bastiaansen
Centralize vCenter log files with vRealize Log Insight. Configuration with vSphere is simple and enables the centralization and transmission of event... Continue Reading
Use ESXi firewall configuration settings and VMkernel ports to control the levels of access that different services, such as Secure Shell, have to ... Continue Reading
The host in a VMware high availability cluster uses a heartbeat network that can incorrectly report host isolation. Reconfigure your settings to ... Continue Reading