ESXi

 View Only
  • 1.  Analyze ESX log

    Posted Feb 12, 2010 12:54 PM

    Hi all,

    I’m trying to get my ESX logs analyzed but I don’t find any log reference guide.

    Does anyone see it? Where can I find it?

    Some more details:

    I’m checking the /var/log/vmware/hosd.log and have a huge amount of events. Some of them are referenced with event id, like the following:

    Event 42 : Reconfigured HOSTNAME on vmware.domain.com in ha-datacenter

    Now I know this line means that VLAN interface has changed on HOSTNAME, but have a lot of events like this.

    Thanx in advance



  • 2.  RE: Analyze ESX log

    Posted Mar 10, 2011 06:47 PM

    You will find quite a few events in VMware that do not show the exact operation that happened.

    Particularly, configuration changes in the hostnetworksystem and configuration changes in individual virtual machine don't contain parameters of what actually changed.

    Unfortunately, since the parameters are not even logged, analyzing the logs will not help much.

    If precise log information that includes this parameters, the IP address of the client the effected the change and operations that were attempted but not authorized, you may want to try a tool like HyTrust.

    http://www.vmware.com/appliances/directory/166453?SRC=WWW_VMW_VAM_Featured_504_166453

    Many of our customers buy it precisely for that purpose.



  • 3.  RE: Analyze ESX log

    Posted Mar 10, 2011 07:34 PM

    There is a utility that you  can at the Tech Support console called vmkerrcode that can give you a little information. I copy it off from time to time.

    http://budgetvirtual.com/wp-content/themes/prosumer/files/errcode.xls

    If you have a real issue though I would use VMware support.



  • 4.  RE: Analyze ESX log

    Posted Mar 10, 2011 07:56 PM

    This could help but it is quite a read from different sources...

    http://communities.vmware.com/docs/DOC-3930

    http://answers.oreilly.com/topic/363-how-to-analyze-vmware-esx-login-logs/

    http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1011641

    and this one is like mother to all Event ID's :smileywink: http://www.eventid.net/ - we are using this on daily basis in my workplace :smileyhappy:

    IMHO VMware should create something like EventID website for reference...

    Regards,

    M.F.