This article provides information on how to collect VMware vSAN support logs and upload them to VMware.

• As vSAN is an object-network based storage system distributed across multiple ESXi hosts, when troubleshooting vSAN issues the entire cluster logs including vCenter are required for a complete analysis of the issue. For example:
  • If you have a 5-host cluster using a RAID1 policy the 3 components that make up that object are distributed across 3 hosts in the cluster per vSANs choosing. However, the error seen can be on a host that doesn't own any of those components or the object in question that needs to be troubleshot.
  • If you have a 10-host cluster using a RAID5 or RAID6 policy the components that make up the object will be laid out across 4 or 6 hosts depending on the RAID 5/6 policy in use.
• So, as you can see based on the above examples if we don't have the entire cluster logs for analysis then we won't have all the pieces of the puzzle to provide an accurate/complete analysis.
• The only exceptions when we wouldn't need the entire cluster logs is for a disk failure called out on a specific host or a PSOD where the backtrace doesn't mention vSAN, LSOM, and/or DOM. For these instances, just the affected host bundle will suffice.
• When troubleshooting vSAN Performance issues additional vSAN Performance data is required for analysis. See KB Collecting vSAN Performance Service data for vSAN performance issues (51477) for collecting this additional Perf data.

• It's highly recommended that the cluster logs are collected before vCenter logs to ensure we get all the required logging from the hosts at the time of the event as host logs tend to wrap faster than vCenter logs.
• When dealing with large clusters 20+ hosts and collecting logs via vCenter it's best to collect the host logs in small batches, no more than 5 at a time to ensure the logs don't get corrupt.