ESXi log files

[TylerDurden77]

Hi all,
How to you review log files on an ESXi 4.1 host?
I'm trying to review the VMkernel log files by powercli with this command:

Get-VMHost esxiserver | Get-Log messages | select-expand property entries
This works well but i do only see entries for the last hour!?

How do you see the older logs?
(I dont have a syslog server, default installation of ESXi 4.1)

Regards

tyler

[Dave_Mishchenko]

You can use - the vSphere client - go to Home > System logs - the vCLI vifs command - http://www.vm-help.com/esx/esx3i/esx_3i_rcli/vifs.php - https:///host - then download the file you want You can also get a support bundle which will contain the complete logs - File > Export > Export System logs in the vSphere client or Get-Log -Bundle with PowerCLI.

[TylerDurden77]

Hi Dave,

Thanks for ur fast replay.

I would like to see the vmkernel logfiles...

But when surf to http://esxhost/host and download message i still only see entries for the last hour.

Are the logfiles rotated and to be find somewhere else?

When i download the bundle throw the vSphere client i cant find any vmkernel logfiles.

The bundle is rather big so i suppose its there somewhere but i cant find them :smileywink:

See alot of win logs and viclient.log.... and more but no vmkernel log. (messages)

Gonna try the RCLI now.

Regards

//Tyler the noob

[Dave_Mishchenko]

You'll want to look for messages*.  That's the VMkernel log file.  On the system those are stored in /var/log/ and ESXi keeps 10 copies archived.  But as /var is part of the RAM disk the files are gone when the system reboots.  You can configure a copy of logs to go to a datastore using Configuration > Software > Advanced Settings (look at the syslog settings).  With 4.1 installed to HD ESXi will set the syslog datastore location to the scratch folder.

[TylerDurden77]

Hi,

Bare with me :smileywink:

I still dont get it.

With powercli i can only se /var/log/messages   (only information of the last hour)

I want to se the vmkernel log of the last couple of days...

With https i can only see "messages" (same info as with powercli)

Throw the vSphere client i cant find "messages" at all.

I have now enable RemoteTechSupport and browse down to /var/log/

Can here see "messages" (same info as above)

Here i can also see message.0.gz -message7.gz

I suspect that this is the logfiles im looking for. (the older vmkernel logs?)

Are these files to be find in the "bundle" downloaded throw vSphere client?

If not i have to figure out how to copy this messages.gz files to my win7 workstation and figure out how to open gz files throw windows....

Regards

Tyler

[Dave_Mishchenko]

With the client, PowerCLI, vifs and htps you can only get the current log file.  The support bundle has the archived files.  Open up the export bundle and browse into the server archive (I use 7-zip).  Keep going until you see a bunch of folders.  One will be var.  Open that, then logs and you'll see the log files.

[TylerDurden77]

Thanks!!

Gonna try that soon. (lunch time here)

Regards

Tyler

[TylerDurden77]

Dave,

I have now found the var/log using 7-zip.

I can extract messages.3.gz to a folder named message 3

In the folder i have a file called message.3 (1017kb)

How could i open this file throw my win7 workstation?

Now able to open the files....

Still looks like its only for the last day....

Will digg deeper.

Regards

Tyler

[Dave_Mishchenko]

Within the support bundle you'll find the logs in this path - [e-mail]\[e-mail]\vm-support-esx01-2011-02-11--09.06.25921849\var\log\.

[bulletprooffool]

firstly, for real time monitoring, try:

http://www.lucd.info/2010/10/08/nearly-real-time-monitoring/

Running

(get-vmhost esxserver | get-log messages).entries

On my environment returns logs going back several days (to my last syslogd restart)

Hope this helps  . .

[TylerDurden77]

Hi,

On my 3 ESXi 4.1

(get-vmhost ESX | get-log messages).entries

First entry = Feb 11 07:14:40

Last entry = Feb 11 13:09:16

Regards

Tyler

[bulletprooffool]

Hi - looks like you now have 4 hours of logs?

so your log reader coder is fine, you are just missing entries in your logs (I am guessing the first log reads something like:

xxxxxxx  syslogd 1.4.1: restart

You can see ESX logs:

• From the Service Console
• From the vSphere Client connected directly to the ESX host (click Home > Administration > System Logs)
• From the VMware Infrastructure Client connected directly to the ESX  host (click Administration > System Logs)

The messages log (which logs activity on the Service Console operating  system) is located at /var/log/messages

If you'd like older logs (as a one-off) you can connect to your ESX host (using Putty / SCP etc) and browse to /var/log

the older logs will be called messages.1, messages.2 etc.

This will get your info for this visit. - not sure if you can get the older logs with PowerCli though (LucD knows . . I am sure ;-) )

7Zip and any text editor will let you open these.

[TylerDurden77]

Hi,

My logs are only 6 hours back in time

/vmfs/volumes/4c3b41dd-c5a0ba17-fdbe-001f29e9f30c/log # ls -ln
-rwx------    1 0        0                 90846 Feb 11 13:53 messages
-rwx------    1 0        0               1048635 Feb 11 13:25 messages.0
-rwx------    1 0        0                 88054 Feb 11 13:53 messages.0.gz
-rwx------    1 0        0                 87367 Feb 11 13:25 messages.1.gz
-rwx------    1 0        0                 77609 Feb 11 12:59 messages.2.gz
-rwx------    1 0        0                 77707 Feb 11 12:23 messages.3.gz
-rwx------    1 0        0                 74504 Feb 11 11:47 messages.4.gz
-rwx------    1 0        0                 75088 Feb 11 11:10 messages.5.gz
-rwx------    1 0        0                 71085 Feb 11 10:34 messages.6.gz
-rwx------    1 0        0                 84359 Feb 11 10:05 messages.7.gz

Cant find any older vmkernel logs on my servers.....

[bulletprooffool]

tyler - it is very odd that you are generating so many new logs - crack them open and see if each of them is start with a message saying that the syslogd has just started. If this is the case, something is restarting the service (quite regularly) and thus shifting the log numbers each time . . of course you only keep 10 logs back . .so are not keeping much in the way of time of logs.

If you'd like to amend your logging settings look at:

/etc/logrotate.conf

If you have a different host that is behaving properly, it will be useful to compare these conf files.

If they are identical, and you have the message telling you about a service restart on each log file, you need to figure out what is causing these restarts

[TylerDurden77]

Hi,

Its the same with a newly installed ESXi 4.1 u1 server.

I can only see the vmkernel logs for the last hours...

Im doing something terrible wrong :smileyhappy:

//Tyler

[Dave_Mishchenko]

You can run tail -f /var/log/messages to monitor the output of the log file.  It may be that you have a repeating error message occurring.  In general ESXi won't store much log history so if you need to go back to access log data you should consider setting up a syslog server or vilogger from the vMA.

[TylerDurden77]

Hi Dave,

Thanks for all your help :smileyhappy:

I have now downloaded system logs from the vSphere Client from multiple ESX 4.0 and ESX 4.1 servers.

In /var/log i see:

messages

and

messages.0.gz     to     messages.7gz

When i read theese log files i only see info of the last 2 days. (on some systems only for the last couple of hours)

I dont have any problems with my ESX servers right now, just trying to learn how to interpret the logfiles when something happens.

What i have i have learned so far (or think ive learned) is that you have to use a syslog server to be able to see older logfiles. (more than 2 days)

If you could confirm above this thread will be closed.

Again, thanks for all your time.

Regards

Tyler

[Dave_Mishchenko]

You can use a syslog server or vilogger - http://www.simonlong.co.uk/blog/2010/05/28/using-vma-as-your-esxi-syslog-server/.