Where to find logs for ESX, vCenter, the VCF Installer and the VCF Operations products.
From Ultra Transcenders 2V0-18.25 by Tony Rough (coming November 2026)
Log locations differ by component, and this table is an index only: each later chapter explains how to read the logs for its area. Exact file names are given where the documentation states them.
| Component | Location | What it records |
|---|---|---|
| VCF Installer | /var/log/vmware/vcf/domainmanager/domainmanager.log |
Validation and deployment activity by the domain manager service |
| ESX host agent | /var/log/hostd.log |
The agent that manages and configures the host and its VMs |
| ESX vCenter agent | /var/log/vpxa.log |
The agent that talks to vCenter |
| ESX system messages | /var/log/syslog.log |
General log messages |
| ESX VMkernel | /var/log/vmkernel.log, /var/log/vmkwarning.log |
Activity related to VMs and ESX |
| ESX uptime summary | /var/log/vmksummary.log |
Uptime and availability statistics |
| ESX authentication | /var/log/auth.log |
Local authentication events |
| ESX Shell | /var/log/shell.log |
Commands typed into the shell and shell events |
| ESX Quick Boot | /var/log/loadESX.log |
Restarts through Quick Boot |
| ESX observations | vobd.log |
VMkernel Observations, usable for vSAN alarms |
| Virtual machine | vmware.log and vmware*.log, next to the VM’s configuration files |
Power events, failures, Tools status, hardware changes, vMotion |
| vCenter services | /var/log/vmware/<service_name> |
One directory per service |
| vSphere Client | /var/log/vmware/vsphere-ui/logs |
Main file vsphere_client_virgo.log |
| VCF Operations | Administration > Control Panel > Support Logs | Browse by node or log type; set levels and sizes |
| Cloud proxy | /storage/log; /var/log/firstboot |
Proxy logs; a file named Succeeded confirms first boot worked |
| VCF Operations orchestrator | /services-logs/prelude/vco-app/console-logs/vco-server-app.log; /services-logs/prelude/vco-app/file-logs/vco-server-app_cfg-cli.log |
Server console output; output of CLI commands, including the exception when a command returns non-zero with no specific error on screen |
Under /var/log/vmware/, the vCenter directories below cover the services that later chapters refer to.
| Directory | Service |
|---|---|
vpxd |
VMware vCenter |
vpostgres |
VMware Postgres service |
vcha |
vCenter High Availability |
vmon |
VMware Service Lifecycle Manager |
rhttpproxy |
VMware HTTP Reverse Proxy |
vmdird |
VMware Directory Service |
vmafdd |
VMware Authentication Framework |
applmgmt, applmgmt-audit |
VMware Appliance Management Service |
eam |
VMware ESX Agent Manager |
vmware-sps |
vSphere Profile-Driven Storage Service |
sca |
VMware Service Control Agent |
The vCenter logging page also lists ../firstboot, which stores first boot logs. Separately, one vSphere page gives /var/run/log as the directory for ESX system logs, while the log locations table above uses /var/log for these files and /var/run/log only for the Trust Authority logs.
Common trap: All ESX logging is under one directory, so a VM’s failure will be in
/var/log- a virtual machine’s logs are stored with its configuration files on the datastore, for example under/vmfs/volumes/, not in the host’s log directory.
Common trap: Reading VCF Operations log times as local time because the appliance has a time zone set - the VCF Operations logs remain in UTC even if a time zone is configured for the VM, while the system logs follow that time zone. Convert before correlating with other evidence.
This note is one section of Ultra Transcenders 2V0-18.25: VMware vSphere Foundation 9.0 Support, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Broadcom TechDocs.
Due on Amazon in November 2026, in Kindle and paperback editions.
About the book · 2V0-18.25 terms in the glossary · All 2V0-18.25 study notes
Where to start with a VVF fault: the VCF Installer, VCF Operations features, or a component's own tools.
How the starting state of an existing vSphere environment decides the path to VVF 9.0.
What evaluation mode allows, what happens when a licence expires, and how recovery works.
What Connected, Not Responding and Disconnected mean, and what each means for running VMs.
What each vSphere HA agent state says about a host, and what it means for failover.
Which objects stay available after each single failure in a vSAN stretched cluster.
How to tell All Paths Down from Permanent Device Loss on ESX, and what each does to VMs.