VMware Log Troubleshooting Cheat Sheet

Oct 22, 2025

4 min read

Updated: Jul 30

Key Log Files & What They Cover

Log File	Location	Purpose / Common Use
vmkernel.log	ESXi host: /var/log/vmkernel.log	Core VMkernel activities: drivers, storage paths, network, device discovery. Use when host-level hardware / I/O / performance issues.
vmkwarning.log	ESXi host: /var/log/vmkwarning.log	Warnings issued by VMkernel. Good early-warning log.
hostd.log	ESXi host: /var/log/hostd.log	ESXi host management service (hostd): VM power operations, connection to vCenter, host management.
vmware.log	VM directory on datastore: e.g., [datastore]/VM_Name/vmware.log	Per-VM log: VM operations, snapshots, guest OS issues, VM hardware / configuration changes.
vpxd.log	vCenter Server (VCSA): /var/log/vmware/vpxd/vpxd.log	vCenter service log: inventory, tasks, cluster operations, host communication.
fdm.log	ESXi host: /var/log/fdm.log (for HA)	High Availability (HA) service: e.g., master election, host failure, VM restart events.
vobd.log	ESXi host: /var/log/vobd.log	Events from the On-board Diagnostics (OBD) system: hardware, storage, path errors.
shell.log	ESXi host: /var/log/shell.log	Shell/ESXi commands executed by admins. Good for auditing accidental/misconfiguration changes.

Troubleshooting Flow – How to Use Logs Efficiently

Define the problem – What is broken? Host crash, VM freeze, migration failure, high latency etc.
Pick relevant log(s) – Based on problem type (host vs VM vs vCenter).
Search for errors/warnings – Use grep/tail e.g., grep -i “error” vmkernel.log.
Correlate timestamps – Match when failure happened with log entries across different logs.
Check context – What changed recently: updates, hardware, network, storage.
Implement fix & validate – After making a change, monitor logs for recurrence.
Document & Prevent – Note root cause and add preventive controls or monitoring alerts.

⚠️ Common Scenarios with Log-File Roles

Scenario	Logs to check	What to look for
VM unable to power on	vmware.log, hostd.log	Errors like incompatible hardware version, missing storage path.
Host experiencing storage I/O errors	vmkernel.log, vobd.log	SCSI errors, path timeouts, device unreachable.
vMotion fails	vmkernel.log, vpxd.log	Network link down, migration errors, host incompatibility.
HA cluster failover problems	fdm.log, vpxd.log	Host not entering master state, missing heartbeat datastores.
vCenter service not starting	vpxd.log, vpxa.log (on hosts)	Exceptions, DB connection errors, time-skew issues.
Network issues on host/VM	vmkernel.log, hostd.log	Packet dropped, NIC link down, teaming mis-config.
VM performance degradation (host resources)	vmkernel.log, shell.log	Ballooning, swapping, resource overcommit.

🧮 Useful Commands for Log Navigation on ESXi

# View live log tail: tail -f /var/log/vmkernel.log # Search for errors in a log: grep -i "error" /var/log/hostd.log # Find entries around a timestamp: grep -i -C5 "2025-10-22 14:30" /var/log/vmkernel.log # List kernel logs directory: ls -lh /var/log | grep kernel # For per-VM log (download): scp root@esxi_host:/vmfs/volumes/datastore/VM_Name/vmware.log

🛠️ ESXi Host: Key Commands & Techniques

Log file locations (quick reference)

/var/log/vmkernel.log – core VMkernel logs: storage, network, device discovery.
/var/log/hostd.log – host management service (VM operations, vCenter agent, SDK).
/var/log/vobd.log – VMkernel Observation events, hardware/firmware alerts.
/var/log/shell.log – shell command history (useful for auditing).
/var/log/auth.log – authentication events (SSH, console).

CLI commands & how to use them

Basic browsing

# Follow live log entries in vmkernel tail -f /var/log/vmkernel.log # View last 100 lines of hostd log tail -n 100 /var/log/hostd.log # Search for “error” in vobd grep -i "error" /var/log/vobd.log

These simple commands are outlined in VMware “Newbie’s guide” style.

More advanced grep/context search

# Find disk timeout errors in kernel log grep -i -C5 "timeout" /var/log/vmkernel.log # Search for shell commands executed by a specific session ID grep "WORLD=64386" /var/log/shell.log

Correlating auth.log with shell.log helps in auditing shell usage.

ESXCLI for hardware, network, storage info

# List paths for a datastore esxcli storage core path list --device <naa> # Show network vmkernel adapters esxcli network vmkernel list # Show system modules esxcli system module list

These help diagnose hardware/driver issues, host-capability mismatches, etc.

Generating support bundles

# On ESXi host vm-support # Alternatively via web https://<host-IP>/cgi-bin/vm-support.cgi

Useful when you need to collect full logs for troubleshooting or escalation.

Syslog/location change

# Example: change syslog directory esxcli system syslog config set --logdir="[Datastore1]/logs/" # Restart syslog service then

Useful when you need persistent logs stored to a datastore rather than default scratch.

Use-cases & what to watch

Storage I/O issues → check vmkernel.log, vobd.log, run path list, verify multipathing.
Host unresponsive or PSOD → look in vmkernel.log, /var/log/boot.gz, check hardware drivers.
Unauthorized shell/SSH usage → correlate auth.log + shell.log to find user commands.
vMotion/migration failures → hostd.log, vobd.log, network path lists, hardware module mismatch.

📍 vCenter Server: Key Commands & Techniques

Log file locations (quick reference)

On VCSA: /var/log/vmware/vpxd/vpxd.log – core vCenter service.
Also: /var/log/vmware/vpxd/vpxd-alert.log, /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log – UI/plugin issues.

CLI / appliance commands

Service status / restart

# On VCSA appliance shell service-control --status --all # To restart vSphere UI service-control --restart vsphere-ui

Useful when plugin UI (like vSAN Health) isn't loading.

Export system logs

In vCenter UI: Menu → Administration → System Logs → Export System Logs…From appliance CLI:

vc-support

Generates full support bundle for vCenter.

Inspect plugin issues

# On vCenter appliance via shell grep -i "plugin" /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log

Helpful when a UI tab (e.g., vSAN Health) fails to load due to missing plugin.

Use-cases & what to watch

Missing UI tabs or plugin failures → check UI logs, plugin status, vCenter version/compatibility.
vCenter service repeatedly stops/crashes → vpxd.log, vpxd-alert.log, check DB connectivity, time sync.
Host registration/migration errors → vpxd.log for SOAP/API errors, check vpxd.log for “host not supported” messages.
Cluster/DRS/HA fault logs → vpxd.log, check host errors, verify heartbeat datastores, licensing.

Key Log Files & What They Cover

Log File

Location

Purpose / Common Use

vmkernel.log

ESXi host: /var/log/vmkernel.log

Core VMkernel activities: drivers, storage paths, network, device discovery. Use when host-level hardware / I/O / performance issues.

vmkwarning.log

ESXi host: /var/log/vmkwarning.log

Warnings issued by VMkernel. Good early-warning log.

hostd.log

ESXi host: /var/log/hostd.log

ESXi host management service (hostd): VM power operations, connection to vCenter, host management.

vmware.log

VM directory on datastore: e.g., [datastore]/VM_Name/vmware.log

Per-VM log: VM operations, snapshots, guest OS issues, VM hardware / configuration changes.

vpxd.log

vCenter Server (VCSA): /var/log/vmware/vpxd/vpxd.log

vCenter service log: inventory, tasks, cluster operations, host communication.

fdm.log

ESXi host: /var/log/fdm.log (for HA)

High Availability (HA) service: e.g., master election, host failure, VM restart events.

vobd.log

ESXi host: /var/log/vobd.log

Events from the On-board Diagnostics (OBD) system: hardware, storage, path errors.

shell.log

ESXi host: /var/log/shell.log

Shell/ESXi commands executed by admins. Good for auditing accidental/misconfiguration changes.

Troubleshooting Flow – How to Use Logs Efficiently

Define the problem – What is broken? Host crash, VM freeze, migration failure, high latency etc.

Pick relevant log(s) – Based on problem type (host vs VM vs vCenter).

Search for errors/warnings – Use grep/tail e.g., grep -i “error” vmkernel.log.

Correlate timestamps – Match when failure happened with log entries across different logs.

Check context – What changed recently: updates, hardware, network, storage.

Implement fix & validate – After making a change, monitor logs for recurrence.

Document & Prevent – Note root cause and add preventive controls or monitoring alerts.

⚠️ Common Scenarios with Log-File Roles

Scenario

Logs to check

What to look for

VM unable to power on

vmware.log, hostd.log

Errors like incompatible hardware version, missing storage path.

Host experiencing storage I/O errors

vmkernel.log, vobd.log

SCSI errors, path timeouts, device unreachable.

vMotion fails

vmkernel.log, vpxd.log

Network link down, migration errors, host incompatibility.

HA cluster failover problems

fdm.log, vpxd.log

Host not entering master state, missing heartbeat datastores.

vCenter service not starting

vpxd.log, vpxa.log (on hosts)

Exceptions, DB connection errors, time-skew issues.

Network issues on host/VM

vmkernel.log, hostd.log

Packet dropped, NIC link down, teaming mis-config.

VM performance degradation (host resources)

vmkernel.log, shell.log

Ballooning, swapping, resource overcommit.

🧮 Useful Commands for Log Navigation on ESXi

🛠️ ESXi Host: Key Commands & Techniques

Log file locations (quick reference)

/var/log/vmkernel.log – core VMkernel logs: storage, network, device discovery.

/var/log/hostd.log – host management service (VM operations, vCenter agent, SDK).

/var/log/vobd.log – VMkernel Observation events, hardware/firmware alerts.

/var/log/shell.log – shell command history (useful for auditing).

/var/log/auth.log – authentication events (SSH, console).

CLI commands & how to use them

Basic browsing

# Follow live log entries in vmkernel tail -f /var/log/vmkernel.log # View last 100 lines of hostd log tail -n 100 /var/log/hostd.log # Search for “error” in vobd grep -i "error" /var/log/vobd.log

These simple commands are outlined in VMware “Newbie’s guide” style.

More advanced grep/context search

# Find disk timeout errors in kernel log grep -i -C5 "timeout" /var/log/vmkernel.log # Search for shell commands executed by a specific session ID grep "WORLD=64386" /var/log/shell.log

Correlating auth.log with shell.log helps in auditing shell usage.

ESXCLI for hardware, network, storage info

# List paths for a datastore esxcli storage core path list --device <naa> # Show network vmkernel adapters esxcli network vmkernel list # Show system modules esxcli system module list

These help diagnose hardware/driver issues, host-capability mismatches, etc.

Generating support bundles