Once you understand VM file types, you'll want to become very familiar with log files. Log files are the best method for troubleshooting problems with virtual machines. It's the first place you should check when problems occur.
The most important file is the VMware.log file. This is the main log file for the VM on the ESX server, and is located in the working directory for the VM. Vmware.log is always the current working log for the VM and older log files are incremented numerically, i.e. vmware-1.log
You should also check /var/log/vmkernel and /var/log/vmware/hostd.log on the ESX host for any errors that may be related to the problem you are experiencing with your VM. Sometimes, restarting the hostd service (service mgmt-vmware restart) on the ESX host will resolve quirky problems with virtual machines. For more common problems, there are more specific techniques that will likely resolve your problem; I'll go over these next.
- VMkernel - /var/log/vmkernel - Records activities related to the virtual machines and ESX server. Rotated with a numeric extension, current log has no extension, most recent has a ".1? extension.
- VMkernel Warnings - /var/log/vmkwarning - Records activities with the virtual machines, a subset of the VMkernel log and uses the same rotation scheme.
- VMkernel Summary - /var/log/vmksummary - Used to determine uptime and availability statistics for ESX Server; readable summary found in /var/log/vmksummary.txt.
- ESX Server host agent log - /var/log/vmware/hostd.log - Contains information on the agent that manages and configures the ESX Server host and its virtual machines. (Search the file date/time stamps to find the log file it is currently outputting to, or open hostd.log, which is linked to the current log file.)
- ESX Firewall log - /var/log/vmware/esxcfg-firewall.log - Logs all firewall rule events.
- ESX Update log - /var/log/vmware/esxupdate.log - Logs all updates done through the esxupdate tool.
- Service Console - /var/log/messages - Contains all general log messages used to troubleshoot virtual machines or ESX Server.
- Web Access - /var/log/vmware/webAccess - Records information on web-based access to ESX Server.
- Authentication log - /var/log/secure - Contains records of connections that require authentication, such as VMware daemons and actions initiated by the xinetd daemon.
- Vpxa log - /var/log/vmware/vpx - Contains information on the agent that communicates with VirtualCenter. Search the file date/time stamps to find the log file it is currently outputting to or open hostd.log which is linked to the current log file.