ESXi : Using VMA to manage ESXi server logs
ESXi uses a scratch partition to store logs files; when a server is restarted/rebooted logs will be lost. Using vMA it is possible to ship logs to another server in order to preserve them for troubleshooting purposes.
Logs are stored under /var/log/vmware/
The following logs are collected from ESXi servers:
- Hostd – Host Management service log
- messages – VMkernel, vmkwarning, and hostd log
- vpxa – vCenter Agent log
The settings defined in your vMA setup will determine how many logs are stored for your ESXi hosts, for example the following command will store 20 log files with a maximum size of 10MB per log file, logs will be collected every 10 seconds:
vilogger enable –server vm01.domain.local –numrotation 20 –maxfilesize 10 –collectionperiod 10
It is also possible to use the built-in syslog server to store logs to a datastore: http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=1016621