Where are vCenter logs?

Managing logs is an important part of administering any VMware vSphere environment powered by vCenter Server. vCenter Server and related components generate logs that provide valuable insights into operations, performance, and issues. Knowing where vCenter logs are located will enable faster troubleshooting and streamline log analysis.

Overview of vCenter Server Logging

vCenter Server manages logs for all integrated vSphere components, including:

  • vCenter Server service logs
  • Platform Services Controller (PSC) logs
  • Update Manager logs
  • Auto Deploy logs
  • ESXi host logs
  • vSphere Client logs

By centralizing logging, vCenter Server makes it easier to collect and analyze logs in one place instead of having to gather logs from multiple components separately.

vCenter generates verbose logging by default to ensure availability of sufficient details. The logs use a standard format and get rotated based on defined policies to prevent unchecked growth of log files.

Log Locations in vCenter

The exact locations for vCenter/PSC logs depends on:

  • Deployment model – VCSA (Virtual Appliance) or Windows install
  • Version – vSphere 6.x or later

However, the logs can always be found in select folders of the vCenter Server file system.

Log locations for vCenter Server Appliance (VCSA):

  • /var/log/vmware/ – Contains logs for vCenter Server services
  • /storage/log/ – Additional vCenter/PSC logs
  • /var/log/vpdb/ – vCenter Database logs

The VCSA includes log aggregation/management via the vcsa-logs utility.

Log locations for Windows vCenter installs:

  • %PROGRAMDATA%\VMware\CIS\logs – vCenter/PSC logs
  • %PROGRAMFILES%\VMware\Infrastructure\VirtualCenter Server\Logs – Additional vCenter logs

For external PSC deployments on Windows, logs are under:

  • %PROGRAMFILES%\VMware\CIS\logs

This covers the most common vCenter log directories. Next, we see how to access and collect logs for troubleshooting.

Accessing and Collecting vCenter Logs

vCenter logs contain details covering operations, performance, events, and errors. They include information on ESXi hosts, virtual machines, vCenter services, etc. managed in the environment.

Here are key steps to access and collect vCenter logs:

Log into vCenter Server

Log into the vCenter Server web client using admin credentials to access logs:

  • VCSA: https://vcsa-hostname/vsphere-client
  • Windows: https://windows-machine/vsphere-client

This allows browsing logs directly or downloading them.

Browse Recent Logs

Under vCenter Server Tasks and Events, check Recent Tasks to see consolidated logging for vCenter service activity.

The Events tab shows notifications from vCenter and integrated components. Use filters to narrow down events for troubleshooting issues.

Access Log Directories

Log directly into the vCenter Server machine to browse log directories:

  • VCSA: SSH as root user
  • Windows: Remote desktop as Administrator

Navigate to log folders listed earlier to find component-specific logs.

Use cd and ls to access logs. Open files with cat or edit them.

Collect Logs from vSphere Client

The vSphere Client includes a Generate Log Bundles action that collects logs:

  1. Click Menu > Administration > Support and licensing > Generate log bundles
  2. Select components (e.g vCenter Server)
  3. Set time frame and log levels
  4. Click Generate log bundle

This creates a ZIP archive containing relevant logs for that component across products.

The bundle provides a complete log set for troubleshooting rather than needing to collect logs individually.

Use log aggregation tool (VCSA)

The VCSA includes vcsa-logs which combines logs from ESXi hosts and vCenter into one archive. This tool has options for:

  • Including/excluding specific logs
  • Setting time range for logs collected
  • Filtering logs by text string

To use it:

  1. Log into VCSA CLI
  2. Run command vcsa-logs with parameters
  3. Find created .zip archive in /var/tmp or other location

This quickly lets you grab logs without downloading separate files manually.

No matter your method, collecting comprehensive logs is vital for rapid troubleshooting of vCenter Server problems.

Key Log Types and Information

The previous section covered where vCenter Server logs are located and methods to access logs. This section explores key vCenter log types and the information contained in these logs.

vCenter Server Service Logs

These log the overall vCenter Server appliance/service operations and performance.

Key logs are:

Log Information
vpxd.log Records runtime details on vCenter services
vmware-vmon.log Hardware stats and monitoring
vmware-rbd-watchdog.log Manages vCenter/PSC replicated state

The vpx user process generates most logs. Filter vpxd logs by warning/error to see issues.

vCenter Agent Manager Logs

The casa tool manages vSphere agents connecting to vCenter. Its logs help troubleshoot agent issues:

  • /var/log/vmware/casa/casa.log
  • <%PROGRAMDATA%\VMware\vCenterServer\logs\casa>

vSphere Client Logs

The vSphere clients log service connection issues, GUI errors etc.:

  • VCSA – /var/log/vmware/vsphere-ui/vc-ui.log
  • Windows – <vCenter_install_dir\vsphere-client\serviceability\logs>

Filter by error to find client-side problems.

vCenter Database Logs

Database logs record vCenter DB operations, statements, errors and more:

  • /var/log/vpdb.log (VCSA PostgreSQL logs)
  • %PROGRAMFILES%\VMware\Infrastructure\VirtualCenter Server\Logs\vpxd\vpx\ (MS SQL logs on Windows)

Slow DB queries indicate performance issues.DB corruption errors are critical.

Analyzing relevant vCenter logs helps precisely diagnose issues in the environment.

vCenter Log Management Best Practices

Effective vCenter log management is crucial given the volume of logs generated. This section provides tips and best practices to properly manage vCenter/vSphere logs:

Set Log Rotation Policies

Define log rotation policies so logs get compressed/archived over time preventing unchecked growth. VCSA log rotation is configured via:

Copy code

/etc/logrotate.d/logrotate.conf

For Windows check MaxFileSize and MaxLogFileSize registry settings.

Adjust Log Verbosity

Change log levels to troubleshoot issues without enabling full verbose logging always.

Adjust VCSA log levels via /etc/vmware-syslog/vmware-syslog.properties. On Windows edit registry keys like VerboseLevel globally or per component.

Centralize Logs with SIEM

Send vCenter logs to enterprise SIEM tool for correlation, monitoring and retention. For VCSA, configure syslog forwarding to send logs externally. On Windows, use omnisend for log forwarding.

Monitor Log Sizes

Check log sizes regularly so they don’t consume excessive storage. Configure alarms at 75% space threshold. Archive/truncate unwanted logs.

Proper vCenter log management improves system performance while providing readily available logs for troubleshooting.

Key Takeaway

  • vCenter Server centralizes and manages logging for all integrated vSphere components
  • Log locations differ slightly based on VCSA or Windows installation, version etc. but vCenter logs are found in specific folders
  • Tasks/Events pane and log bundles in vSphere Client provide convenient access to recent vCenter events/logs
  • Log collection for troubleshooting can also be done via CLI/file system access or using VCSA log tools
  • Critical vCenter logs include vpxd, database logs, vSphere Client logs etc. that provide insights into operations, events and errors
  • Follow best practices around log rotations, verbosity levels, forwarding, monitoring and archival for optimal vCenter log management

Conclusion

vCenter Server logging delivers consolidated insights into VMware vSphere environments. Identifying default log locations, collecting relevant logs, and analyzing log data enables faster diagnosis and remediation of issues. Implementing log management best practices balances troubleshooting capability with storage needs and performance. Mastering the log landscape empowers admins to unlock the full value of vCenter Server for infrastructure management.

Frequently Asked Questions

Q: Where are migration logs kept in vCenter Server?
A: vCenter migration logs are available under /var/log/vmware/mgmt-vim or %PROGRAMDATA%\VMware\vCenterServer\logs\migration on VCSA and Windows respectively.

Q: Does vCenter Server embed ESXi host logs?
A: No, vCenter centralizes and correlates vSphere logs, but raw ESXi host logs are stored locally on the ESXi server. They can be accessed via SSH.

Q: Can you adjust vCenter logging levels?
A: Yes, vCenter Server logging levels can customized at a granular component level by editing the logging properties file on VCSA or updating registry keys on Windows.

Q: What protocol does vCenter use for remote logging?
A: VCSA supports both UDP and TCP syslog protocols for forwarding logs to remote servers. Windows uses TCP only.

Q: Where are event database logs located on vCenter Server?
A: The vCenter Server event log database files are kept under /var/log/vmware/vpx/ on VCSA and  <SystemDrive>:\ProgramData\VMware\CIS\logs on Windows.

Q: Which logs show vCenter performance data?
A: vpxd.log captures overall vCenter Server performance metrics. The vmware-statsmonitor.log file logs performance statistics for system health monitoring.

Q: How long are vCenter Server logs retained by default?
A: By default, VCSA preserves logs for 30 days while Windows vCenter keeps them for 15 days. This can be customized by changing log rotation settings.

Q: What tool allows collecting both vCenter and ESXi logs?
A: On VCSA installations, the vcsa-logs utility generates a consolidated log bundle including both vCenter and ESXi logs.

Q: Where can you view tasks, events and notifications in vCenter Server?
A: Recent tasks, events from vCenter services, and alert notifications are accessible from the vSphere Client under Menu > Tasks & Events.

Q: What causes excessive vCenter Server database logging?
A: Frequent DB schema changes, statement recompilation, and excessive stored procedure execution can result in increased database logging in vCenter Server.

Q: How do you resolve log file growth issues in vCenter?
A: Configure log rotation policies correctly, archive/delete old logs, adjust log levels to reduce verbosity, and monitor log sizes proactively.

Q: What tool allows exporting vCenter logs to a zip file?
A: The Export System Logs action in vCenter Server allows logging directly to a zipped bundle for easy downloading and sharing of logs.

Q: Where can you check Postgres database logs on a vCSA instance?
A: On vCenter Server appliances, Postgres database logs are available under /storage/log/vmware/vpostgres/ on the vCSA server.

Q: What powers the log collection capability in vCenter Server?
A: vCenter uses a logging framework called log insight that aggregates and manages logs from all components.

Q: How can you monitor vCenter syslog event notifications?
A: Syslog data from vCenter Server is sent to /var/log/vmware/vpx/vpxd.log on VCSA. On Windows check ProgramData\VMware\CIS\logs\VMwareSC\scvmkvp.log

 

Leave a Comment