Techpot's Blog

VMware ESX/ESXi and Syslog

TechPot — Sun, 24 Jul 2011 09:03:01 +0000

We all know that log files provides wealth of information when there is a need to troubleshoot an issue or while investigating a security incident to give you some examples. There is already lot written about VMware ESXi hosts and vCenter log files. However in this post, I am going to explore this topic from a very basic point of view. So let’s get started.

Q1. What are the different log files that exists on ESXi hosts? And where are they stored?

A1. By default, the common log files are stored as specified below:

The VMkernel, vmkwarning, and hostd logs are located at /var/log/messages.
The Host Management service (hostd = Host daemon) log is located at /var/log/vmware/hostd.log.
The VirtualCenter Agent log is located at /var/log/vmware/vpx/vpxa.log.
The System boot log is located at /var/log/sysboot.log.

Please read this article for more details.

Q2. Why do we need to send the VMware ESX/ESXi log files to another server such as a Syslog server?

A2. By default the VMware ESXi server stores log files in a scratch partition on the local disk. The scratch partition is non-persistent by default, meaning the contents it holds will be lost when the host server is rebooted or powered-off.

Q3. Is there a way to make scratch partition persistent?

A3. Yes, navigate to this article for more details.

Q4. When is the scratch partition created?

A4. During installation of ESX/ESXi, upon first reboot.

Q.5 What happens if there is no sufficient space on local disk to create a scratch partition?

A5. A portion of RAM will be used as scratch partition. This portion is called RAM disk.

Q6. What does the scratch partition contain?

A6. It contains log files, diagnostic info and system swap.

Q7. So how to send the log files to remote Syslog server?

A7. This is a two step process, usually.

Make sure a Syslog server exists in your network. Few examples of Syslog server are VMware vMA vilogger, splunk, etc.
Configure your ESXi hosts to send the log files to the Syslog server.

Note: The procedure on how to configure the above two components depends on the software you are using. Below, are few references:

Enabling syslog on ESXi

ESXi 4.1 remote log collection with VMware vMA 4.1

Using vMA as a syslog collector

Additionally, the recently previewed vSphere 5 includes a syslogger component that appears to be very easy to setup. Jason Boche has blogged about this new feature on his blog which is here. As you have read above there are various options to record and maintained vSphere log files that will be handy while troubleshooting your vSphere environment.

Filed under: ESXi, Vmware

VMware vSphere 5.0 License and Edition Comparison

TechPot — Thu, 21 Jul 2011 09:24:26 +0000

VMware vSphere 5.0 License and Edition Comparison matrix is available here, here and here.

Filed under: Vmware

VMware vSphere 5 Licensing – Tutorial

TechPot — Mon, 18 Jul 2011 15:14:51 +0000

VMware vSphere 5 Licensing tutorial is available here.

Filed under: Vmware

vSphere 5 Links

TechPot — Fri, 15 Jul 2011 19:13:03 +0000

Massive vSphere 5 links collected by Eric Siebert is available here.

Filed under: Vmware

Simple VMware vSphere 4 & 5 License Calculator

TechPot — Fri, 15 Jul 2011 18:57:08 +0000

Simple VMware vSphere 4 & 5 License Calculator is available @ http://www.virtualvcp.com/download-tools/164-simple-vmware-vsphere-4-a-5-license-calculator

Filed under: Vmware

VMware vSphere 5: The BIG feature list

TechPot — Fri, 15 Jul 2011 18:38:45 +0000

A quick list of new VMware vSphere 5 features is available @ http://vmguy.com/wordpress/index.php/archives/1674

Filed under: Cloud Computing, Vmware

VMware ESX Disk Configuration Options

TechPot — Mon, 27 Jun 2011 17:15:37 +0000

VMware ESX offers several options for creating virtual disks (i.e., VMDK files) for your virtual machines (VMs). This article covers options for thin and thick VM disk provisioning, along with general recommendations and guidelines for storing VMDK files on ESX DAS and SANs. It’s especially important to consider the block size when formatting an ESX storage group; otherwise, you might have to back up any existing VMs and reformat the storage group. These disk configuration parameters have a significant effect on functionality, performance, and manageability.

Full article is here.

Filed under: ESXi, Server Virtualization, Vmware

The vCluster” – A Highly Available Dynamic Blade Solution Design with Vsphere 4

TechPot — Sat, 11 Jun 2011 19:56:47 +0000

The vCluster” – A Highly Available Dynamic Blade Solution Design with Vsphere 4 is available here.

Filed under: HP, Vmware