The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides
Search the VMware Knowledge Base (KB)
View by Article ID
ESXi 5.0 host logs not found in /var/log (2031485)
Symptoms
On an ESXi 5.0 host, you do not find any log files in /var/log.
The vmsyslogd process is not running on the host.
You may not be able to scan a host for baseline compliance with vCenter Update Manager.
Purpose
This article provides a resolution for missing symbolic links in /var/log which point to /scratch/log.
Cause
By default, logging is configured on an ESXi 5.0 host to log to /scratch/log, and symbolic links pointing to these files are located in /var/log. These symbolic links may not be created if the vmsyslogd process is not running on the host because it did not start successfully during a host reboot.
During the boot process, vmsyslogd reads the configuration file at /etc/vmsyslog.conf. If this configuration file has a syslog host configured, the logs are then output to the syslog server and not the local /scratch partition.
However, if the syslog server has been set up in error, or if the FQDN for the syslog host can not be resolved by the ping command from the ESXi host, vmsyslogd will not start during a host reboot.
Resolution
To resolve this issue, correct any syslog host configuration errors, or remove the syslog configuration on the ESXi host:
If a syslog host is being used for ESXi logging in the environment:
Ensure that the DNS and server IP addresses are correct in the /etc/resolv.conf file.
Ensure that you can vmkping the FQDN of the defined syslog host.
If a syslog host has been set up in error on the ESXi host:
Remove the syslog host's FQDN:
Using the vSphere Client, connect to the host directly or to the vCenter Server.
Click the host's Configuration tab.
Under Software, click Advanced Settings.
Click syslog and delete the FQDN from the logHost field and click OK to commit the changes.
Ensure that the changes have been successfully committed:
Note: If the vmsyslogd process is running, you see lines echoed to the SSH session with corresponding PIDs. If the output is another blank command line, the process is not running.
If the process is running, confirm that symbolic links for the logs to /scratch/log are present by running the command:
ls -la /var/log
Confirm that logging has resumed successfully by running the command:
less /var/log/hostd.log
Press Shift+G to go to the bottom of the less output, and observe the time stamp value. A very recent time stamp (within the last seconds to minutes) indicates that logging has resumed successfully on the host.
