Recently I had to take a look at some vCenter logs, and I realized logs are not something I have talked about that much, especially when it comes to vCenter.  The truth is that we can learn quite a bit about what is going on in our environment, and looking at vCenter logs can help us with troubleshooting.

If we open a case with VMware, they will often ask us to send them our log files so they can take a look, so it is important to how where they are located, and how to access them.

We are going to take a look at two different ways to take a look at your vCenter logs:

• Export the vCenter logs to your computer
• Look at the logs on the VCSA directly

We will also briefly cover the main log file to look at, and how to send your logs to VMware support.

Exporting vCenter Server Logs to Your Computer

One way to export your vCenter Server logs is to do it from the vSphere client.

Simply right click on your vCenter in the inventory pane, and select Export System Logs…

You’ll be met with the following screen which will give you a couple options. You can export ESXi logs and vCenter logs by clicking the appropriate buttons.  Today, we are just going to grab the vCenter logs.

In the next screen, you can specify if you want performance data, and also put a password on your core dumps if you would like to.  We are not going to select these things since we aren’t having any specific issues, we’re just playing around.

If you do have an issue in your vSphere environment, VMware support may ask you to export your logs, with specific options in this screen.  You can also upload these logs to VMware directly in vCenter.

Once we select EXPORT LOGS we are ready to go.  You will see the file begin to download.  This may take a while depending on the size of your VMware vSphere environment.

Viewing Your vCenter Logs

Once the download is complete, you can extract the file.

The download from vCenter is a Zip file with a TGZ file inside.  You will need to extract them both.

Head on over to the /var/log/vmware in the file you extracted to take a look at your log files.

There’s a lot of stuff here and it is easy to get overwhelmed if you have never taken a look at these logs before.

Chances are good you are going to look at the vpxd log, since this is the main vCenter log.  

It keeps track of basically everything vCenter does, like tasks and events, as well as vSphere client connections.

Reading vCenter Logs

There is a ton of stuff included with the export from vCenter.  If you have some time, it is fun to play around and look through things.  It will give you an even better understanding of how vCenter works, and interacts with ESXi.

The log we are looking for is usually the vpxd.log file, but there are also many other types of log files.  You can find more information on other types of vCenter logs at the VMware KB.

Extract the file you exported, and browse to /var/log/vmware/vpxd

You are looking for a .log file named vpxd, but it likely has a number appended at the end.  In this case it is vpxd-22.log.

To keep the log file sizes reasonable, VMware creates a new log file, and archives the old ones.  Depending on how long you have been having an issue, you may also need to go back to some of the previous log files to take a look.

I like to open the files in Notepad++, since that’s what I generally use as a text editor.  If you try to use regular notepad, you may not have the best experience depending on how large the log file is.

If you just need to take a quick look at a log file because you know what you are looking for, there is a quicker way.

First, let’s take a look at how to upload this file to VMware.

Uploading vSphere Logs to VMware

After your log download has finished, you can upload those logs right to VMware through the vSphere client.

Click on Administration in the vCenter Menu, and click on Upload File to Service Request under Support.

Once you click the Upload button, your will need your Support Request ID.  Then you can browse to the logs you downloaded and click upload.

Viewing Log Files on the VCSA

If you just need to quickly look at a log file, you can ssh directly to your VCSA and take a look at it.

To turn on SSH on your VCSA, log into the VAMI at https://your-vcenter-fqdn.com:5480.

Navigate to the Access tab in the left pane, and click Edit next to access settings.  From here you can toggle the settings on and off.

Next, just SSH to your VCSA, and make sure to start the shell when prompted, by typing shell at the Command> prompt.

Then you can browse to the log fine in /var/log/vmware/vpxd, and take a look at what you have.

If you aren’t a linux person, the command

grep 'error' vpxd.log | more

will show you all of the errors in the log file, and let you cycle through the screen views of them.

This is great when you need to quickly check something.

You can do the same thing if you need to look at logs on an ESXi host, ssh and browse to the directory.  You can also view the logs on an ESXi host by connecting to the host directly with the vSphere Client.

While you may not feel like reading vCenter server logs for fun, it is a good idea to at least know how to access them in case you ever have an issue with your environment.  

VMware makes this easy to do by being able to access them and upload them from the vSphere Client.  If you know what you are looking for and need to quickly take a look at something, you may just want to ssh to the VCSA directly and take a look at them.