How to Configure VMware Log Location on ESXi

VMware ESXi is a hypervisor that similarly, to other operating systems and software products, writes log files. We have covered the most useful VMware logs in a recent blog post, and this post extends the configuration. After installing ESXi, log files are stored in the default location. However, you can change the VMware log location if needed. This blog post explains how to change ESXi log location in the command line and in the graphical user interface (GUI).

NAKIVO for VMware vSphere Backup

Complete data protection for VMware vSphere VMs and instant recovery options. Secure backup targets onsite, offsite and in the cloud. Anti-ransomware features.

DISCOVER SOLUTION

Why Would You Need to Change VMware Logs Location?

VMware ESXi logs are deleted after an ESXi host reboots by default. If you don’t want VMware ESXi logs to be deleted after each host reboot, you can change the VMware logs location on an ESXi host from the default scratch partition to persistent storage, such as a directory on a datastore.

The first approach to configure VMware ESXi to store logs on permanent storage, such as a datastore, is to set up persistent scratch space. By default, ESXi uses an in-memory file system (tmpfs) for scratch space, which means that logs are lost upon a reboot. However, with persistent scratch space, logs will be preserved across reboots and stored on a designated datastore.

The second approach is leaving the scratch partition configuration as is but changing the path to store log files from the scratch partition to a persistent datastore. We use this approach in our example.

You can change the location of VMware ESXi system logs in the ESXi command line and in the GUI, using VMware vSphere Client.

Change ESXi Log Location Using the Command Line

Perform the following steps to change ESXi log location in the command line:

1. First, identify the datastore where you want to store the logs. Ensure that the datastore has sufficient free space to accommodate the log files.
2. Enable SSH and connect to the ESXi host. Use an SSH client (for example, PuTTY) to connect to the ESXi host’s management IP address.
3. Check the current scratch configuration and location of VMware logs. Run the following command to check the current configuration for storing VMware logs:

   esxcli system syslog config get

   As you can see in our output displayed in the screenshot, /scratch/log is the local log output.

   

4. You can also use the command to view the information about the current scratch configuration:

   vim-cmd hostsvc/advopt/view ScratchConfig.ConfiguredScratchLocation

   

5. Note the current scratch location (for example, /tmp/scratch) and whether it is using memory or a specific partition.
6. Create a directory on the datastore. Use the following command to create a directory on the chosen datastore where you want to store the logs:

   mkdir /vmfs/volumes/<datastore_name>/log

   Replace <datastore_name> with the name of the datastore (datastore10a in our case).

   In our case, the command is:

   mkdir /vmfs/volumes/datastore10a/log

7. Set the new location to store VMware logs. You can set a directory on a datastore of the local or remote ESXi host with the command like:

   esxcli system syslog config set --logdir=/vmfs/directory/path --loghost='tcp://hostname:514'

   We set the recently created directory on Datastore10a on our local ESXi host as the new location to store VMware logs with the command:

   esxcli system syslog config set --logdir=/vmfs/volumes/Datastore10a/log

   If you see an error like “Logdir must exist and be a directory“, if the required directory already exists, try to use the datastore (partition) UUID instead of a human-friendly datastore name. The easiest way to check the datastore UUID is to go to the datastore directory:

   cd /vmfs/volumes/Datastore10a/

   See the path of the current directory, where you should see the datastore (partition) UUID. In our case, the UUID of datastore10a is 609a545a-50d29185-ffbb-000c293004f2.

   Run the command to set the new log location by using the datastore UUID instead of the datastore name in the path:

   esxcli system syslog config set --logdir=/vmfs/volumes/609a545a-50d29185-ffbb-000c293004f2/log

   The command has been executed successfully.

   

8. Reload syslog to apply the new settings and start writing logs in a persistent location which is a directory on the datastore:

   esxcli system syslog reload

   

After the reload, ESXi will store its logs in the specified directory on the designated datastore. This will ensure that the logs are preserved across reboots and provide a more permanent and reliable storage solution for log files.

Change ESXi Log Location Using VMware vSphere Client

Perform the following steps to change ESXi log location in the vCenter GUI using VMware vSphere Client:

1. Select the Hosts and clusters view and select the needed ESXi host in the navigation pane (which is located on the left side of the interface).
2. Click the Configure tab and then click Advanced System Settings in the System section of the configuration pane.
3. Find the Syslog.global.logDir key to configure. In our case, this key is located on page 31.

   Click Edit to change the value for the Syslog.global.logDir key.

   

4. A new window to edit advanced system settings opens.

   Change the default /scratch/log value to the custom value that can be a directory on your datastore and click OK to save settings.

   

Changing ESXi Log Location in VMware Host Client

If you don’t have vCenter Server or use a standalone ESXi host, you can change ESXi log location in VMware Host Client:

1. Enter the IP address of an ESXi host in a web browser and log in to VMware Host Client.
2. Go to Host > Manage > System > Advanced settings.
3. Find the Syslog.global.logDir key in the list of options.
4. Select the Syslog.global.logDir key and click the Edit option.

   

5. Enter a new value for ESXi log location in the appropriate field and hit Save.

   

How to Change ESXi Log Location in PowerCLI

If you like vSphere PowerCLI, which is a command line interface based on Windows PowerShell, you can consider the following ways to change VMware ESXi host log location. There can be three scenarios.

Change ESXi log location on a standalone host

1. Open PowerCLI and log in to an ESXi server with administrative credentials:

   Connect-VIServer -Server <ESXiHostIPAddress> -User <Username> -Password <Password>

2. Set the new ESXi log location in PowerCLI:

   Set-VMHostAdvancedConfiguration -VMHost <HostNameOrIPAddress> -Name "Syslog.global.logDir" -Value "[<DatastoreName>] <Path>"

   Replace <DatastoreName> with the name of the datastore where you want to store logs and <Path> with the new directory path for the logs.

Changing ESXi Log Location for multiple ESXi hosts without vCenter

If you have multiple ESXi hosts but they are not managed by vCenter, do the following:

1. Prepare a list of ESXi hosts. Create a text file listing each host’s IP address or hostname, one per line (for example, hosts.txt).
2. Consider an example of the PowerCLI script to set ESXi log location:

   $hosts = Get-Content -Path "C:\path\to\hosts.txt"

   foreach ($host in $hosts) {

   Connect-VIServer -Server $host -User <User> -Password <Password>

   Set-VMHostAdvancedConfiguration -VMHost $host -Name "Syslog.global.logDir" -Value "[<DatastoreName>] <Path>"

   Disconnect-VIServer -Server $host -Confirm:$false

   }

   Enter the needed values based on your environment and infrastructure.

Changing ESXi log location for multiple hosts with vCenter

If your ESXi hosts are managed by vCenter, you can change ESXi log location in PowerShell asfollows:

1. Connect to vCenter Server in PowerCLI:

   Connect-VIServer -Server <vCenterHostNameOrIPAddress> -User <User> -Password <Password>

2. Set ESXi log location for all hosts managed by vCenter:

   Get-VMHost | ForEach-Object {

   Set-VMHostAdvancedConfiguration -VMHost $_ -Name "Syslog.global.logDir" -Value "[<DatastoreName>] <Path>"

   }

   Enter the needed values when running commands to meet the configuration of your environment.

Conclusion

Using persistent storage for ESXi logs allows you to preserve these logs after the ESXi reboot. You can change ESXi log location by using the command line and graphical user interface. If an ESXi host is managed by vCenter Server, you can use VMware vSphere Client. If an ESXi host is not managed by vCenter, use the ESXi command line or VMware Host Client. Organizations having large virtual environments can configure a log server with a shared datastore for writing ESXi logs of multiple hosts to this server.

NAKIVO for VMware vSphere Backup

Complete data protection for VMware vSphere VMs and instant recovery options. Secure backup targets onsite, offsite and in the cloud. Anti-ransomware features.

DISCOVER SOLUTION