Many VMware products offer remote syslog functionality, but some do not include all the logs that you may care about. In addition, some VMware products do not support remote syslog (e.g. VMware products like vCenter Server that run on Windows as Windows does not natively support syslog – more on this in a later post). If you are looking to collect logs from VMware products it is important to understand where the log files are located. Below you will find the appropriate log locations for many VMware products. A big thanks to my colleague Michael White for putting together this list and in particular the vCAC information!
- ESXi (for 4.x and greater if running vCenter Log Insight use configure-esxi!)
- vCenter Server Appliance (VCSA) – http://www.virtuallyghetto.com/2012/08/forwarding-vcenter-server-logs-to.html
- vCloud Automation Center (vCAC)
- Server – %programfiles(x86)%\VMware\vCAC\Server\Logs
- DEM Worker – %programfiles(x86)%\VMware\vCAC\Distributed Execution Manager\DEMWorker\Logs
- DEM Orchestrator – %programfiles(x86)%\VMware\vCAC\Distributed Execution Manager\DEMOrch\Logs
- Agent vSphere – %programfiles(x86)%\VMware\vCAC\Agents\vSphere-Agent-01\logs
- vCloud Director (vCD) – http://kb.vmware.com/kb/2004564
- vCloud Network and Security (vCNS) – http://blogs.vmware.com/vsphere/2013/02/configuring-syslog-servers-and-logging-in-vcloud-networking-and-security-5-1.html
- Some other VMware products – http://kb.vmware.com/kb/1021806
- Note on View – In View 5.2 you can configure it to send remote syslog, but this will ONLY send events. If you want all View server logs then follow the KB above.
Also, be sure to check out this link from William Lam for a great script and some additional log locations: http://www.virtuallyghetto.com/2013/06/forwarding-logs-from-vcloud-suite-to.html
© 2013, Steve Flanders. All rights reserved.