If a virtual server malfunctions, understanding how to use the tasks and events log in VirtualCenter can help you discover what caused the crash. While ESX Server events may seem like a simple topic, I assure you that there is much more to know about ESX Server events than you might think.
What are VMware ESX Server Events?
Just like Windows Server events, VMware ESX Server events tell you when something happened on your VMware ESX Server. The main reason the Tasks and Events tab is useful is because it's context-sensitive to each object in VirtualCenter. This tab can detail the recent tasks and events by data center, cluster, host, resource pool, and virtual machine (VM), which can be very helpful in troubleshooting. Relevant tasks and events are shown for a specific object, across all users or distributed resource scheduler (DRS) initiated functions.
If you are connected to an ESX Server directly, you will see the events for only that server. If you are using VMware VirtualCenter, however, you can look at events across all ESX Servers in a single integrated display. To do this, go to Hosts and Clusters, then the Tasks and Events tab in the VMware Infrastructure Client (VI Client). Here is an example:
As you can see in the graphic, I am able to see events across all servers. There are different types of events, I can see when the event happened, what server the event occurred on and who initiated the event.
If you are used to looking at Windows Server event logs, this type of thing may seem familiar to you. But there are some VMware ESX event features that you may not know about.
5 things that you probably didn't know about ESX Server events
1. You can view events for more than just individual ESX servers
You can also view events for host and clusters (as demonstrated above), data centers, resource pools and virtual machines.
At each level of the VirtualCenter inventory mentioned above, you can view the Tasks and the Events for that object in the inventory. Additionally, you can go to the Events button on the VI Client Toolbar to see events for the entire virtual infrastructure, like this:
2. There are three different types of events: Info, Warning, and Error
3. You can search through events at any level
The search function can be customized to search specific fields. For example, in the graphic below, I will search only in event descriptions, types, and targets. If I wanted to search for events performed by a certain user, I would check User and likely uncheck the other event fields.
In the graphic below, you can see that I added user as a search field and then searched only for events that contained my user name (ddavis). In the results, you can see that all the user fields are the events that were attached to my user name.
Besides searching, you can also sort the columns in the events window by clicking on each of them to sort by ascending or descending order. For example, notice how I clicked on the Type column in the Tasks and Events tab, and that they are now sorted by type.
4. The columns listed in the events window are customizable.
If you right-click on the column headings, you can choose to enable or disable specific event columns from being shown in the event window.
5. You can Export Events or export a list of all events
In the File menu, you can select to either Expert Events or Export List, which is a list of all events. See below:
If you choose Export Events, you will see this:
From here, you can choose where you want the events exported to and all sorts of criteria as to what events you want exported. What you get is a text file that looks like this:
From here, you could choose to import this into Excel or another database for the purpose of reporting or analysis.
If you choose to Export List, you get a HTM formatted list of all events, like this:
Understanding VMware ESX Server events, how they work, and all that they can do is a crucial skill for VMware virtualization administrators to master. In this article, you learned what VMware ESX Server and VMware Infrastructure Events are, the different types of events and how to export, search and customize the events display.
ABOUT THE AUTHOR: David Davis (CCIE #9369, VCP, CWNA, MCSE, CISSP, Linux+, CEH) is the Director of Infrastructure at Train Signal, Inc. He has written hundreds of articles and six video training courses – including the Train Signal VMware ESX Server video training series. His websites are Happy Router.com and VMwareVideos.com.