Configuring the Location of VMware Logs on ESXi

VMware ESXi records host activity in log files written to a default directory when you install the hypervisor. The default ESXi logs location is suitable for a lab, but it may not be persistent or convenient in production. Administrators often change the VMware ESXi logs location and move the records to a datastore or central syslog service. Redirecting the ESXi log directory is an advanced task: schedule it during a maintenance window, record the current configuration so you can roll back, and create a backup before proceeding.

Where are ESXi logs located?

The VMware ESXi logs location depends on the data each service writes and the host configuration. Before changing the ESXi log location, identify the current location of each file. Common log directories include:

1. 1. /var/log/: This is the main ESXi logs directory. Important log files stored here include:

• vmkernel.log: Records VMkernel activity, including device discovery, storage and networking operations, and VM startups and crashes.
• vpxa.log: Contains entries from the vCenter Server agent running on the host and communicating with vCenter.
• hostd.log: Logs activity from the host management daemon, including management interface connections, tasks, and configuration changes.
• syslog.log: Contains general system messages routed through the ESXi syslog service.
• /var/log/vmware/: This directory can also contain logs for VMware services and components.

1. 2. /scratch/log/: When a persistent scratch location is configured, ESXi stores logs here, usually on a VMFS volume, local disk partition, or boot media. Without persistent scratch, which is common on hosts booted from USB or SD cards, the scratch area is on a ramdisk. Its contents, including logs, are lost after every reboot. This is a main reason administrators move the ESXi logs location to a datastore or remote syslog server.
2. 3. /vmfs/volumes/datastore1/: After you change the ESXi log location to a datastore, host logs are written under /vmfs/volumes/DATASTORE-NAME/LOG-DIRECTORY/. Each virtual machine also stores its own vmware.log next to its .vmx configuration file in the VM folder on the datastore.

You can view these files directly in the ESXi Host Client or vSphere Client, or manage them from the command line with esxcli. You can also export logs or redirect them to a remote syslog server for centralized management and longer-term storage.

Why change the default location of VMware logs?

There are several practical reasons to change the ESXi log location rather than keep the default directory:

• Storage Space Management: The default location often uses a small scratch or boot partition that can fill quickly, especially on hosts with limited local storage. Changing the ESXi log location to a datastore with more free space prevents the partition from filling, which could otherwise cause system instability or degraded performance.
• Data Security: Log files often contain sensitive information about your environment. Storing them in a secured area with appropriate access controls supports security policies and regulatory compliance and helps protect the data from unauthorized access.
• System Performance: Writing logs requires constant I/O operations. If logs share a storage device with critical applications, that traffic can affect application performance. Moving the ESXi logs directory to a less busy device reduces this impact.
• Backup and Recovery: Centralizing log files in one location makes them easier to back up and restore. This is particularly important for VMware disaster recovery, where logs can provide vital information about the system state before a failure occurred.
• Ease of Management: A standardized ESXi log directory across all hosts simplifies monitoring, searching, and alerting, especially in environments with multiple ESXi servers. Centralized logs also simplify deployment of comprehensive monitoring and analysis tools.

esxcli system syslog config get
    

esxcli system syslog config set --logdir=/vmfs/volumes/datastore1/new_log_directory
    

esxcli system syslog reload
    

esxcli system syslog config get
    

tail -f /vmfs/volumes/datastore1/new_log_directory/vmkernel.log
    

Modify ESXi Log Location Through VMware vSphere Client

To change the VMware ESXi log location through the VMware vSphere Client, follow these steps. This method suits administrators who prefer a graphical user interface over command-line interaction and is useful in vCenter-managed environments.

Step 1: Connect to vCenter Server

1. 1. Open your web browser and navigate to the vCenter Server by entering its IP address or domain name.
2. 2. Log in with your administrator credentials to access the VMware vSphere Client.

Step 2: Access Host Settings

1. 1. From the vSphere Client home screen, navigate to the Hosts and Clusters section.
2. 2. Select the ESXi host for which you want to change the log location from the inventory tree on the left-hand side.
3. 3. Click the Configure tab on the right-hand panel.

Step 3: Modify Advanced System Settings

1. 1. Under the System category, find and click on Advanced System Settings.
2. 2. Use the search bar to find the setting named Syslog.global.logDir. This setting determines the ESXi log directory where logs are stored.

Step 4: Change the Log File Location

1. 1. Select the Syslog.global.logDir setting and click the Edit button (pencil icon).
2. 2. In the dialog box that appears, enter the new directory path in the Value field. The path format is [DatastoreName] directory_path/, where DatastoreName is the name of your datastore and directory_path/ is the folder for your logs. For example, [Datastore1] logs/.
3. 3. Click OK to save the changes.

Step 5: Restart Syslog Service

To apply the changes, restart the syslog service on the ESXi host:

1. 1. Navigate back to the host by selecting it in the inventory.
2. 2. Open an SSH or ESXi Shell session for the selected host.
3. 3. Connect to the host through SSH or the ESXi Shell and run esxcli system syslog reload to apply the settings.

Step 6: Verify the Changes

To ensure that the logs are being written to the new location:

1. 1. Return to Advanced System Settings and verify that Syslog.global.logDir shows the new path.
2. 2. Optionally, connect to the host through SSH and list the new directory with ls to confirm that log files are present.
3. 3. Open one of the files with tail -f and confirm that fresh entries continue to arrive.

Additional Considerations

• Ensure that the specified datastore has sufficient free space and remains accessible to the ESXi host.
• If several hosts share the same datastore, enable Syslog.global.logDirUnique so each host writes to its own subdirectory rather than mixing log files.
• Remember that changing the log location can affect scripts or monitoring tools that access these logs, so update those tools accordingly.
• Keep in mind data protection and compliance requirements when moving log files to a new location.

Changing ESXi Log Location Using PowerCLI

Changing the ESXi log location with VMware PowerCLI efficiently automates logging settings across one or multiple hosts, whether they are managed individually or through vCenter. PowerCLI edits the same Syslog.global.logDir advanced setting as the manual methods, so the result on the host is identical. The following workflows cover each scenario.

Modify ESXi Log Location on a Standalone Host

Step 1: Connect to the ESXi Host

First, open PowerCLI and connect to your ESXi host:

$standaloneConnection = Connect-VIServer -Server "esxi01.example.com" -User "root" -Password "your_password"

Step 2: Change the Log Directory

To change the ESXi log directory, update the Syslog.global.logDir advanced setting:

Get-VMHost -Server $standaloneConnection | Get-AdvancedSetting -Name "Syslog.global.logDir" | Set-AdvancedSetting -Value "[Datastore1] logs/"

Replace [Datastore1] logs/ with your own datastore and folder. Note that the Set-VMHostSysLogServer cmdlet has a different purpose: it forwards logs to a remote syslog server, for example Set-VMHostSysLogServer -SysLogServer "tcp://syslog.example.com:514", rather than setting the local log directory.

Step 3: Restart Syslog Service

Restart the syslog service to apply the changes:

Get-VMHost -Server $standaloneConnection | ForEach-Object { (Get-EsxCli -VMHost $_ -V2).system.syslog.reload.Invoke() }

Step 4: Confirm the Change

Verify the new setting with:

Get-VMHost -Server $standaloneConnection | Get-AdvancedSetting -Name "Syslog.global.logDir"

Adjusting ESXi Log Location for Multiple Hosts Without vCenter

Step 1: Connect to Each Host

Loop through each host to connect to it. Use a variable name such as $vmhost, because $host is a reserved PowerShell variable:

$vmhosts = @("192.168.10.21", "192.168.10.22")
$hostConnections = foreach ($vmhost in $vmhosts) {
    Connect-VIServer -Server $vmhost -User "root" -Password "your_password"
}

Step 2: Apply Changes

Apply the new log directory settings and restart the syslog service on each host:

foreach ($connection in $hostConnections) {
    Get-VMHost -Server $connection | Get-AdvancedSetting -Name "Syslog.global.logDir" | Set-AdvancedSetting -Value "[Datastore1] logs/"
    (Get-EsxCli -VMHost (Get-VMHost -Server $connection) -V2).system.syslog.reload.Invoke()
    }

Step 3: Verify Changes

Check the settings for each host:

foreach ($connection in $hostConnections) {
    Get-VMHost -Server $connection | Get-AdvancedSetting -Name "Syslog.global.logDir"
    }

Modifying ESXi Log Location for Multiple Hosts Using vCenter

Step 1: Connect to vCenter

Connect to your vCenter server:

$vcenterConnection = Connect-VIServer -Server "vcenter01.example.com" -User "administrator@vsphere.local" -Password "your_password"

Step 2: Change Log Location for All Hosts

Retrieve all hosts and set the log directory for each one:

Get-VMHost -Server $vcenterConnection | Get-AdvancedSetting -Name "Syslog.global.logDir" | Set-AdvancedSetting -Value "[Datastore1] logs/"

Step 3: Restart Services

Restart the syslog service on all hosts:

Get-VMHost -Server $vcenterConnection | ForEach-Object { (Get-EsxCli -VMHost $_ -V2).system.syslog.reload.Invoke() }

Step 4: Confirm Changes

Confirm that the log directory has been updated on all hosts:

Get-VMHost -Server $vcenterConnection | Get-AdvancedSetting -Name "Syslog.global.logDir"

These steps provide a streamlined way to change the ESXi logs location with PowerCLI across different setups, from a single host to an entire cluster managed through vCenter. Because this change can affect many hosts at once, test it on one host first. Confirm that log files appear in the new ESXi logs directory before rolling it out to the rest of the environment.

How recover files in VMware on ESXi?

DiskInternals VMFS Recovery is a powerful tool designed to recover data from VMFS (Virtual Machine File System) drives used by VMware ESXi servers. This software can be very useful if you've lost data due to deletion, formatting, VM failure, or other scenarios. Here’s how to use DiskInternals VMFS Recovery to recover files in VMware on ESXi:

Step 1: Install DiskInternals VMFS Recovery

First, download and install DiskInternals VMFS Recovery on a Windows computer. It's important to perform recovery operations from a separate system to avoid overwriting data on the ESXi host.

Step 2: Connect to the ESXi Server

1. 1. Launch DiskInternals VMFS Recovery.
2. 2. Connect to the ESXi server hosting the datastores you want to recover from. You can connect either directly if the disks are locally attached to your Windows machine or over the network if they are on a remote ESXi server.
   • If connecting directly, ensure the disks from the ESXi host are properly connected to the machine where VMFS Recovery is installed.
   • If connecting over the network, you will need the IP address, and possibly credentials, to access the ESXi server.

Step 3: Scan the VMFS Drives

1. 1. Choose the drive or partition that contains the VMFS file system.
2. 2. Start the scanning process. DiskInternals VMFS Recovery will scan the selected VMFS drives for any recoverable data. This process can take some time depending on the size of the drives and the extent of the damage.

Step 4: Recover the Files

1. 1. Browse the recovered files. After the scan, you can browse through the file system tree to locate the specific files or virtual machine disks (VMDKs) you want to recover.
2. 2. Preview the files. VMFS Recovery allows you to preview recoverable files before saving them, which helps confirm the integrity of the data.
3. 3. Save the recovered files to a safe location. Ensure you save them on a different drive to avoid potential data overwriting.

Step 5: Restore VMDK Files to ESXi Server

After recovering the VMDK files, you can upload them back to your ESXi server:

1. 1. Use VMware vSphere Client to connect to your ESXi server.
2. 2. Upload the VMDK files to the appropriate datastore.
3. 3. Attach the VMDK files to the respective virtual machines or create new VMs using these VMDK files as disks.

Additional Tips

• It’s crucial to act quickly and not write any new data to the VMFS volumes once you suspect data loss to prevent data overwriting.
• If the VMFS system is severely corrupted, consider contacting professional data recovery services that specialize in VMFS.

Conclusion

Changing the VMware ESXi log location is a small configuration task with significant operational benefits. The default ESXi logs location is acceptable for quick lab work, but moving the ESXi log directory to a persistent datastore or central syslog service preserves troubleshooting evidence, supports compliance and retention requirements, and prevents small boot devices from filling. The workflow is the same regardless of the interface: command line, vSphere Client, VMware Host Client, or PowerCLI. Choose persistent storage, record the previous setting, apply the change, reload the syslog service, and verify that new entries reach the destination.

If VMFS data is lost, stop writes to the affected storage and recover files to a separate destination. DiskInternals VMFS Recovery can scan supported VMFS volumes for recoverable virtual disks and other files.

Keep a record of each host’s log destination and retention settings so logs are available when an incident requires investigation.

FAQ

Related articles

FREE DOWNLOADVer 4.28, WinBUY NOWFrom $699