VMware Log Troubleshooting Cheat Sheet
- sathyahraj
- Oct 22
- 4 min read
Key Log Files & What They Cover
🧰 Troubleshooting Flow – How to Use Logs Efficiently
Define the problem – What is broken? Host crash, VM freeze, migration failure, high latency etc.
Pick relevant log(s) – Based on problem type (host vs VM vs vCenter).
Search for errors/warnings – Use grep/tail e.g., grep -i “error” vmkernel.log.
Correlate timestamps – Match when failure happened with log entries across different logs.
Check context – What changed recently: updates, hardware, network, storage.
Implement fix & validate – After making a change, monitor logs for recurrence.
Document & Prevent – Note root cause and add preventive controls or monitoring alerts.
⚠️ Common Scenarios with Log-File Roles
🧮 Useful Commands for Log Navigation on ESXi
# View live log tail:
tail -f /var/log/vmkernel.log
# Search for errors in a log:
grep -i "error" /var/log/hostd.log
# Find entries around a timestamp:
grep -i -C5 "2025-10-22 14:30" /var/log/vmkernel.log
# List kernel logs directory:
ls -lh /var/log | grep kernel
# For per-VM log (download):
scp root@esxi_host:/vmfs/volumes/datastore/VM_Name/vmware.log
🛠️ ESXi Host: Key Commands & Techniques
Log file locations (quick reference)
/var/log/vmkernel.log – core VMkernel logs: storage, network, device discovery.
/var/log/hostd.log – host management service (VM operations, vCenter agent, SDK).
/var/log/vobd.log – VMkernel Observation events, hardware/firmware alerts.
/var/log/shell.log – shell command history (useful for auditing).
/var/log/auth.log – authentication events (SSH, console).
CLI commands & how to use them
Basic browsing
# Follow live log entries in vmkernel
tail -f /var/log/vmkernel.log
# View last 100 lines of hostd log
tail -n 100 /var/log/hostd.log
# Search for “error” in vobd
grep -i "error" /var/log/vobd.log
These simple commands are outlined in VMware “Newbie’s guide” style.
More advanced grep/context search
# Find disk timeout errors in kernel log
grep -i -C5 "timeout" /var/log/vmkernel.log
# Search for shell commands executed by a specific session ID
grep "WORLD=64386" /var/log/shell.log
Correlating auth.log with shell.log helps in auditing shell usage.
ESXCLI for hardware, network, storage info
# List paths for a datastore
esxcli storage core path list --device <naa>
# Show network vmkernel adapters
esxcli network vmkernel list
# Show system modules
esxcli system module list
These help diagnose hardware/driver issues, host-capability mismatches, etc.
Generating support bundles
# On ESXi host
vm-support
# Alternatively via web
https://<host-IP>/cgi-bin/vm-support.cgi
Useful when you need to collect full logs for troubleshooting or escalation.
Syslog/location change
# Example: change syslog directory
esxcli system syslog config set --logdir="[Datastore1]/logs/"
# Restart syslog service then
Useful when you need persistent logs stored to a datastore rather than default scratch.
Use-cases & what to watch
Storage I/O issues → check vmkernel.log, vobd.log, run path list, verify multipathing.
Host unresponsive or PSOD → look in vmkernel.log, /var/log/boot.gz, check hardware drivers.
Unauthorized shell/SSH usage → correlate auth.log + shell.log to find user commands.
vMotion/migration failures → hostd.log, vobd.log, network path lists, hardware module mismatch.
📍 vCenter Server: Key Commands & Techniques
Log file locations (quick reference)
On VCSA: /var/log/vmware/vpxd/vpxd.log – core vCenter service.
Also: /var/log/vmware/vpxd/vpxd-alert.log, /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log – UI/plugin issues.
CLI / appliance commands
Service status / restart
# On VCSA appliance shell
service-control --status --all
# To restart vSphere UI
service-control --restart vsphere-ui
Useful when plugin UI (like vSAN Health) isn't loading.
Export system logs
In vCenter UI: Menu → Administration → System Logs → Export System Logs…From appliance CLI:
vc-support
Generates full support bundle for vCenter.
Inspect plugin issues
# On vCenter appliance via shell
grep -i "plugin" /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log
Helpful when a UI tab (e.g., vSAN Health) fails to load due to missing plugin.
Use-cases & what to watch
Missing UI tabs or plugin failures → check UI logs, plugin status, vCenter version/compatibility.
vCenter service repeatedly stops/crashes → vpxd.log, vpxd-alert.log, check DB connectivity, time sync.
Host registration/migration errors → vpxd.log for SOAP/API errors, check vpxd.log for “host not supported” messages.
Cluster/DRS/HA fault logs → vpxd.log, check host errors, verify heartbeat datastores, licensing.
Comments