What is required in order to have Get-Log -Bundle to work for an ESXi host?

[Tocano]

I can connect to a vCenter and fetch a log bundle for the vCenter itself:

> Connect-VIServer -Server vCenterFQDN -Credential (Get-Credential)
...
> Get-Log -Bundle -DestinationPath E:\Downloads\
VERBOSE: 7/11/2023 11:11:07 AM Get-Log Finished execution
Data
----
E:\Downloads\vcsupport-[guid].tgz

This works fine. 

However, when I attempt to download a log bundle from an ESXi host, nothing happens.

> $vmHost = Get-VMHost esxiHostnameFQDN
> $vmHost | Get-Log -Bundle -DestinationPath E:\Downloads\
VERBOSE: 7/11/2023 11:32:35 AM Get-Log Finished execution
> 

At which point, nothing happens. No error that I can see. No empty file created. No verbose lines indicating an issue or other information whatsoever. It just returns next prompt and doesn't do anything.

So while it is less than ideal, I decided I'd directly connect to the various ESXi hosts I want to get log bundles from and get the logs individually that way. 

> Connect-VIServer -Server esxiHostnameFQDN -Credential (Get-Credential) # root
...
> Get-Log -Bundle -DestinationPath E:\Downloads\
VERBOSE: 7/11/2023 12:13:39 PM Get-Log Finished execution
Get-Log: 7/11/2023 12:13:41 PM Get-Log The operation for the entity "[esxiHostnameFQDN]" failed with the following message: "A general system error occurred: Internal error"
Get-Log: 7/11/2023 12:13:41 PM Get-Log 7/11/2023 12:13:41 PM Get-Log The operation for the entity "[esxiHostnameFQDN]" failed with the following message: "A general system error occurred: Internal error"

Well that's not a very helpful error message. And I'm kind of hitting a roadblock.

Perhaps something with permissions? I mean, I'm using an admin (though not [e-mail]) when connecting to the vCenter. And I'm connecting as root to the ESXi directly. So that doesn't feel like the problem.

I started feeling this might be something like firewall blocking needed ports or some issue with a self-signed certificate or something. However, if - from the same host I'm running the PSConsole - I hit the UI for the host (https://[esxiHostnameFQDN]/ui) I can download the log bundle through the /cgi-bin/vm-support.cgi endpoint. So I have the necessary ports open for https and whatever PowerCLI/Connect-VIServer uses to connect to the host. Plus, I'm neither getting any warnings about certificates when I hit that host via PowerCLI nor through the https UI. 

So I'm at a bit of a loss and am trying to understand what might be going on here. 

Any help would be appreciated. 

EnvInfo:

> $PSVersionTable

Name Value
---- -----
PSVersion 7.3.4
PSEdition Core
GitCommitId 7.3.4
OS Microsoft Windows 10.0.17763
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

> Get-PowerCLIVersion
PowerCLI Version
----------------
VMware.PowerCLI 13.1.0 build 21624340
---------------
Component Versions
---------------
VMware Common PowerCLI Component 13.1 build 21605386
VMware Cis Core PowerCLI Component PowerCLI Component 13.1 build 21605976
VMware VimAutomation VICore Commands PowerCLI Component PowerCLI Component 13.1 build 21606170

> $global:DefaultVIServer | Select Version,Build

Version Build
------- -----
8.0.1 21860503

> $vmHost | Select Version,Build

Version Build
------- -----
8.0.1 21495797

 

[LucD]

The -Bundle parameter is part of the logBundleSet of the Get-Log cmdlet.
It is only valid for a vCenter.

For retrieving logs from ESXi nodes you need the logSet parameterset.
There the Key parameter allows you to indicate which specific log you want to retrieve.
The allowed values on the Key parameter can be found under the Key property of the objects returned by Get-LogType

For example something like this

$timeStamp = (Get-Date).ToString('yyyyMMdd-HHmm')

Get-VMHost -PipelineVariable esx |
ForEach-Object -Process {
   Get-LogType -VMHost $esx -PipelineVariable log |
   ForEach-Object -Process {
      Get-Log -VMHost $esx -Key $log.Key |
      Select -ExpandProperty Entries |
      Out-File -FilePath .\"log-$($esx.Name)-$($log.Key)-$timeStamp.log"
   }
}

[Tocano]

I appreciate the prompt response. However, I'm confused:

> Get-Help Get-Log -Examples

NAME
Get-Log

SYNOPSIS
This cmdlet retrieves entries from vSphere logs.


-------------------------- Example 1 --------------------------

$keys = Get-LogType

Get-Log -Key $keys[0]

Obtain the available keys. Obtains the first log file from the currently connected vCenter Server system.
-------------------------- Example 2 --------------------------

$vmhost = Get-VMHost Host

$keyList = Get-LogType -VMHost $vmhost

$vmhost | Get-Log -Key $keyList[0] -StartLineNum 1 -NumLines 100

Retrieve the first one hundred log lines for the specified host and key.
-------------------------- Example 3 --------------------------

Get-VMHost Host | Get-Log -Bundle -DestinationPath "D:\VMHostBundeLog"

Retrieve a bundle log for the specified host.

 (see Example 3)

[LucD]

Looks like you discovered an error in the Help examples.
The explanation of the Bundle parameter is quite clear

 

[Tocano]

I see. And I recognize that the description says a vCenter Server. However, the very Get-Log documentation you shared in your first response appears to show that VMHost is a valid parameter of that set. 

I'm not trying to be difficult. I just swear that this used to work - and the Help example and the parameterset documentation seem to reaffirm my memory. And I tend to exhaust trying the more straightforward approach before I adopt more complicated alternatives.

I have no problem taking your recommended approach - as long as zipping the resulting individual log files would satisfy VMware Support as the same as the support bundle generated by the system.  Edit: Your approach returns just 4 specific log files, whereas the log bundle created by the host returns dozens of different logs, plus configuration and state files.

Thanks again.

[LucD]

I support wants a bundle then perhaps ask them how to create one.

[LucD]

Afaik, the VMHost parameter in the logBundleSet parameterset includes the ESXi logs together with the vCenter logs.
Is that what support is asking for?

Also, perhaps try to use the VMHost parameter on the Get-Log cmdlet itself, and not via the pipeline.

[Tocano]

Yeah, passing the VMHost parameter both directly or via the pipeline result in the same behavior: It begins to process, I get a Progress bar, then just nothing happens, no file created, and it returns to prompt.

I've also tried, as I showed, using Connect-VIServer directly to the ESXi host, but that's when I hit the actual error.

I'm starting to even play around with trying to use Invoke-RestMethod to pull from the https://[esxiHostnameFQDN/cgi-bin/vm-support.cgi endpoint. But not having much luck with that yet either. 

I KNOW there's a way to fetch the log bundle created by an ESXi host (or at least there used to be). I swear I used to do it. I just haven't for several years and it felt I was hitting some kind of configuration issue on my end. Just trying to figure out what (and hoping that this hasn't been deprecated and removed)

[LucD]

The Bundle is nothing more than a ZIP of the files.
If you ZIP the files created by the script I posted earlier, can Support live with that?

[Tocano]

I mean, the system generated bundle is certainly more than just the zip of those 4 log files.

The bundle contains lots of additional config files, settings, system files, VM logs, and even the contents of entire system folders. 

I get 4 individual logs from your approach.

> Get-ChildItem -Recurse

Directory: E:\Downloads\logFetchMethods\lucD_Approach

Mode LastWriteTime Length Name
---- ------------- ------ ----
-a--- 7/11/2023 4:50 PM 1402258 log-________________________-fdm-20230711-1550.log
-a--- 7/11/2023 4:50 PM 303708 log-________________________-hostd-20230711-1550.log
-a--- 7/11/2023 4:50 PM 4695792 log-________________________-vmkernel-20230711-1550.log
-a--- 7/11/2023 4:50 PM 5034728 log-________________________-vpxa-20230711-1550.log

When I extract a system generated log bundle:

E:\Downloads\logFetchMethods\systemGeneratedBundleApproach> (Get-ChildItem -Recurse).Count
3854

 

[Tocano]

They'll tell me to log into each UI and click the 'Get Support Bundle' button.  

Which as you know works fine for one or two hosts. But when I need to pull from all 40 hosts in our largest cluster or the over 100 we have across our entire production vCenter, automation is the way to go.