ESXi: where are my log files actually stored? Actually, most of them are in `/scratch/log` which points to a hidden `.locker` directory in a datastore.
Posted by jpluimers on 2021/05/05
A summary of the full gist at [Wayback/Archive.is] ESXi-where-are-my-log-files-stored.txt:
# ls -al / /var/ /var/log/ /var/run/ /scratch/ /scratch/log/ | grep "/\|log\|-\>" /: ... lrwxrwxrwx 1 root root 57 Apr 4 18:16 scratch -> /vmfs/volumes/5ce2d440-72311161-75c5-0025907d9d5c/.locker ... /scratch/: drwxr-xr-x 1 root root 106496 Apr 10 08:40 log /scratch/log/: -rw------- 1 root root 411 Apr 4 18:20 Xorg.log ... -rw------- 1 root root 78835 Apr 4 10:30 syslog.0.gz -rw------- 1 root root 61136 Mar 18 15:05 syslog.1.gz -rw------- 1 root root 60589 Feb 24 00:30 syslog.2.gz -rw------- 1 root root 60373 Feb 1 08:01 syslog.3.gz -rw------- 1 root root 60203 Jan 9 15:50 syslog.4.gz -rw------- 1 root root 59889 Dec 17 23:20 syslog.5.gz -rw------- 1 root root 60398 Nov 25 06:50 syslog.6.gz -rw------- 1 root root 60563 Nov 2 14:25 syslog.7.gz -rw------- 1 root root 531794 Apr 10 09:35 syslog.log ... -rw------- 1 root root 157255 Apr 4 18:17 vvold.log /var/: ... drwxr-xr-x 1 root root 512 Apr 5 19:19 log ... /var/log/: -rw-r--r-- 1 root root 416 Apr 4 18:16 .vmsyslogd.err ... -rw-r--r-- 1 root root 38069 Apr 4 18:20 configRP.log -rw-r--r-- 1 root root 0 Apr 4 18:16 cryptoloader.log ... -rw-r--r-- 1 root root 87 Apr 5 21:57 esxcli.log ... -rw------- 1 root root 3350 Apr 4 18:16 init.log -rw-r--r-- 1 root root 966 Apr 4 18:16 iofilter-init.log ... -rw-r--r-- 1 root root 21769 Apr 4 18:16 jumpstart-esxcli-stdout.log -rw-r--r-- 1 root root 18857 Apr 4 18:16 jumpstart-native-stdout.log -rw-r--r-- 1 root root 10837 Apr 4 18:16 jumpstart-stdout.log -rw-r--r-- 1 root root 0 Apr 4 18:16 kickstart.log ... -rw------- 1 root root 10916 Apr 4 18:16 sysboot.log ... -rw------- 1 root root 64 Apr 10 09:13 tallylog ... /var/run/: lrwxrwxrwx 1 root root 12 Apr 4 18:16 log -> /scratch/log
- Almost all log files (most from
/var/logand all from/var/run/log) are actually persistently stored in/scratch/logand survive reboots. Just a few are non-persistent. /var/log/syslogis being archived as.gzfiles (compressed bygzip).syslogis special: the location can be configured, and even be external: [Wayback] Configuring syslog on ESXi (2003322)
VMware vSphere ESXi 5.0 and higher hosts run a Syslog service (
vmsyslogd) that provides a standard mechanism for logging messages from the VMkernel and other system components. By default in ESXi, these logs are placed on a local scratch volume or a ramdisk. To preserve the logs further, ESXi can be configured to place these logs to an alternate storage location on disk and to send the logs across the network to a Syslog server.- A summary of some of the above log files is at [Wayback] ESXi Log File Locations
–jeroen
The Wiert Corner - irregular stream of stuff 
Leave a Reply