This is reference article for VMware ESXi 5.x logs, their locations and use-cases.

Log File Location




ESXi Shell authentication success and failure



DHCP client service, including discovery, address lease requests and renewals



ESXi patch and update installation logs

Updates, Security


Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client and vCenter Server vpxa agent, and SDK connections.

vCenter, Events, Security, Networking


ESXi Shell usage logs, including enable/disable and every command entered



Early VMkernel startup and module loading



Management service initialization, watchdogs, scheduled tasks and DCUI use

Host Profiles, Security, Networking


USB device arbitration events, such as discovery and pass-through to virtual machines

USB, Security


VMkernel Observation events

Performance, Firewall, Security, Storage, Network


Core VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup

Security, Storage, Network, Performance


A summary of Warning and Alert log messages excerpted from the VMkernel logs

Security, Network, Performance, Storage


A summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption

Network, Performance


vCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent.

Virtual Center Agent, Comm path errors to hostd


vSphere High Availability logs.

HA Events


Located in the same directory as a vmx file for a VM. This log file records information specific to a running instance of a virtual machine, such as startup configuration, operations, and shutdown of the virtual machine.