Have you ever been troubleshooting an issue on a VM and needed to view the detailed information located in the vmware.log file for the VM? When I was an admin, I would download the file from the datastore so I could search through the log messages. The file contains detailed VM activity messages including reconfiguration events, vmotions, VMware tools messages, memory state, power on/off events, features enabled, API requests, etc… It can be used to troubleshoot events leading up to core dumps or kernel panics. You can send these log messages to vRealize Log Insight to quickly search through the log data using Interactive Analytics.
The vmware.log file(s) are located in the VM folder on the datastore where the VM is located.
You will need to update the Configuration Parameters to send the log data; this requires the VM to be powered off. (Note: you must already have your vCenter configured to send logs.)
Once the VM is powered off, right-click on the VM and select edit settings. Click on the VM Options tab, then select Edit Configuration.
Click on Add Configuration Params
Add the parameter vmx.log.syslogID. Include the VM name in the value, for example: <vmname>_vmx_log.
After you power on the VM, verify log flow by searching for the value you entered.
Once it’s ingesting the logs for the VM you can set up an alert for specific events, for example:
If you want to disable logging in the future you can power down the VM and remove the value.
After you click on OK the vmx.log.syslogID will be cleared from the file and the VM will no longer send logs to Log Insight.
I hope you’ve found this information useful. If you’d like to see another topic covered, please leave the details in the comments!
