How To Work With VMware Log Files
(Part 2 – Operation: VM creation and modification)
Johnny Zhang
The goal for this document is how to quickly find the needed information for some of the operations that you do every day such as creating VMs, modify it etc. The example of the log file are collect from VMware ESX 4.1.0 and Vcenter 4.1 with all tasks triggered from VIClient connected to vCenter (I will work on a different document for tasks triggered from ESX host)
Log locations:
VMware ESX 4.1.0:
messages: /var/log/messages* (Those logs show you what happened inside service console)
vmkernel: /var/log/vmkernel* (Those logs give you information about VMkernel and interaction between the VMkernel and attached hardware such as physical NICs, HBAs etc
hostd: /var/log/vmware/hostd*.log (The most important logs to show the interactions between VMkerenl and VMs hosted on this ESX server)
vpxa: /var/log/vmware/vpx/vpxa*.log (vpxa is the agent running on ESX server, it reports everything from the host to vCenter and vice versa. Those logs are used when the issue is not on the ESX host, but between the host and vCenter)
VM used in this example: Johnny-test
Create A VM
We start with the name of the VM (in this example “Johnny-test”)
“grep -i johnny-test /var/log/vmware/hostd* | grep -i "Create called" | less”
In this command we are looking for the VM named “johnny-test” from all hostd logs, and looking for the keyword “Create called” from the output of the first “grep”.
You can also do this from vCenter side, but I’d like to get the complete opID, you will see why later.
Output from this command:
hostd-12.log:[2011-04-11 11:07:45.971 F5ADCB90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000006E-b8] Create called: /vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx
hostd.log:[2011-04-11 11:07:45.971 F5ADCB90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000006E-b8] Create called: /vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx
What we are looking for:
Now we know the log file that content the VM creation is hostd-12.log, this is nice to know since we may have many hostd logs in this directory, narrowing down the log would make our life easier. opID=D935FB67-0000006E-b8. If you read my first document about VMotion, you may already know the opID is a support aid put by engineering in ESX 4.1. It’s extremely useful since the same ID is consistent across all logs (ESX and vCenter). We can see there is a “create called” so we know hostd received a create VM call from vCenter via VIClient. It will also list the path of the VM. (If you wonder why a VM did not show up at the location it suppose to be, this will tell you, if this is instructed to do so or the VM was moved later after the creation) Please keep in mind this opID is the same on the ESX server, but only content the first part for vCenter logs (vpxd-*.log)
opID=D935FB67-0000006E
More from logs:
Let’s work our way down: vCenter (vpxd-*log) --> vpxa (/var/log/vmware/vpx/vpxa*.log on ESX) --> hostd (/var/log/vmware/hostd*.log)
vCenter log:
The logs are located in %ALLUSERSPROFILE%\Application Data\VMware\VMware VirtualCenter\Logs, which translates to C:\Documents and Settings\All Users\Application Data\VMware\VirtualCenter\logs in Windows 2003 and C:\ProgramData\VMware\VMware VirtualCenter\Logs in Windows 2008.
“grep -i D935FB67-0000006E vpxd-[1-9]*.log | less”
Remember we need to use the only the first part of the opID, we are looking for information from vpxd-*logs. Since vpxd-profile*.log are also in the same directory, we look for any files after “vpxd-“ start with a number. Because vpxd-profile*.logs are huge, it can take a long time for grep to finish.
Output of the logs:
vpxd-106.log:[2011-04-11 11:10:32.478 06260 info 'App' opID=D935FB67-0000006E] [VpxLRO] -- BEGIN task-1619 -- group-v22 -- vim.Folder.createVm -- 0B4CA1AE-6FF5-4CAD-8912-FD3150C93CD8(657B630E-620A-47AB-AD72-7D949C5F7F25)
vpxd-106.log:[2011-04-11 11:10:32.899 06260 warning 'App' opID=D935FB67-0000006E] [JrnlFilePersistenceProvider] Got EOF while reading file
vpxd-106.log:[2011-04-11 11:10:32.948 06260 info 'App' opID=D935FB67-0000006E] [VpxdVmprovXaction] Starting journal rollback
vpxd-106.log:[2011-04-11 11:10:32.948 06260 info 'App' opID=D935FB67-0000006E] [VpxdVmprovXaction] Vm provision transaction rollback done
vpxd-106.log:[2011-04-11 11:10:33.083 06260 error 'App' opID=D935FB67-0000006E] [VpxdInvtId::VpxdInvtIdGetVpxApplicationId] The application vcid size cannot be <= 0 or > 64
vpxd-106.log:[2011-04-11 11:10:37.629 06260 info 'App' opID=D935FB67-0000006E] [VpxLRO] -- FINISH task-1619 -- group-v22 -- vim.Folder.createVm -- 0B4CA1AE-6FF5-4CAD-8912-FD3150C93CD8(657B630E-620A-47AB-AD72-7D949C5F7F25)
vpxd-106.log: 06260 verbose 'PropertyProvider' opID=D935FB67-0000006E] RecordOp ASSIGN: info.progress, task-1619
vpxd-106.log:[2011-04-11 11:10:34.988 06260 verbose 'App' opID=D935FB67-0000006E] [TaskInfoListener] Waiting on channel task-45062
vpxd-106.log:[2011-04-11 11:10:34.988 06260 verbose 'App' opID=D935FB67-0000006E] [TaskInfoChannel::GetTaskInfoAsync] task: task-45062 setup for async notification
vpxd-106.log:[2011-04-11 11:10:34.988 06260 verbose 'App' opID=D935FB67-0000006E] [TaskInfoChannel::GetTaskInfo] Ready to block - task: task-45062
vpxd-106.log:[2011-04-11 11:10:35.158 06260 verbose 'App' opID=D935FB67-0000006E] [VpxdVmprovUtil] CreateVm on host returned sanfs://vmfs_uuid:4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx
vpxd-106.log:[2011-04-11 11:10:35.158 06260 verbose 'App' opID=D935FB67-0000006E] [TaskInfoListener::~TaskInfoListener] Connection number = 6277
vpxd-106.log:[2011-04-11 11:10:36.164 06260 verbose 'App' opID=D935FB67-0000006E] [VpxdInvtHost::WaitForSync] moHost = bs-bcs-h137.bsl.vmware.com [vim.HostSystem:host-261], masterGenNo = 17765, syncGenNo = 17780
vpxd-106.log:[2011-04-11 11:10:36.164 06260 verbose 'App' opID=D935FB67-0000006E] [VpxdInvtHost] Queuing sync LRO for host: bs-bcs-h137.bsl.vmware.com
vpxd-106.log:[2011-04-11 11:10:37.600 06260 verbose 'App' opID=D935FB67-0000006E] [VpxdMoHost::RequestResPoolUpdate] Incremented ResPoolSpecGenNo to 682
vpxd-106.log:[2011-04-11 11:10:37.617 06260 verbose 'App' opID=D935FB67-0000006E] [JrnlFilePersistenceProvider::DeleteJournal] Deleting C:\ProgramData\VMware\VMware VirtualCenter\journal\1302534632.2.
vpxd-106.log:[2011-04-11 11:10:37.628 06260 verbose 'PropertyProvider' opID=D935FB67-0000006E] RecordOp ASSIGN: disabledMethod, vm-381
vpxd-106.log:[2011-04-11 11:10:37.629 06260 verbose 'PropertyProvider' opID=D935FB67-0000006E] RecordOp ASSIGN: info.state, task-1619
vpxd-106.log:[2011-04-11 11:10:37.629 06260 verbose 'PropertyProvider' opID=D935FB67-0000006E] RecordOp ASSIGN: info.cancelable, task-1619
vpxd-106.log:[2011-04-11 11:10:37.629 06260 verbose 'PropertyProvider' opID=D935FB67-0000006E] RecordOp ASSIGN: info.result, task-1619
vpxd-106.log:[2011-04-11 11:10:37.629 06260 info 'App' opID=D935FB67-0000006E] [VpxLRO] -- FINISH task-1619 -- group-v22 -- vim.Folder.createVm -- 0B4CA1AE-6FF5-4CAD-8912-FD3150C93CD8(657B630E-620A-47AB-AD72-7D949C5F7F25)
vpxd-106.log:[2011-04-11 11:10:38.600 02796 verbose 'PropertyProvider' opID=D935FB67-0000006E] RecordOp ASSIGN: disabledMethod, vm-381
opID=D935FB67-0000006E] [VpxLRO] -- BEGIN task-1619 -- group-v22 -- vim.Folder.createVm -- 0B4CA1AE-6FF5-4CAD-8912-FD3150C93CD8(657B630E-620A-47AB-AD72-7D949C5F7F25)
Every task will have a task ID which will be send to vCenter DB. All tasks have a “BEGIN” and a “FINISH”. In this case, we have a task number 1619, the first UUID is instance UUID, and the one in the brackets is the VM UUID.
error 'App' opID=D935FB67-0000006E] [VpxdInvtId::VpxdInvtIdGetVpxApplicationId] The application vcid size cannot be <= 0 or > 64
Here, this is not an error. vCenter did a pre-check and sure enough find the VCID to be 0 (since the ID never existed before). You can ignore this message in most cases.
FINISH task-1619 -- group-v22 -- vim.Folder.createVm -- 0B4CA1AE-6FF5-4CAD-8912-FD3150C93CD8(657B630E-620A-47AB-AD72-7D949C5F7F25)
Task 1619 finished
Vpxa logs:
“grep -i D935FB67-0000006E-b8 /var/log/vmware/vpx/vpxa* | less”
I will only put part of the logs output here:
vpxa-205.log:[2011-04-11 11:07:44.854 F701CB90 verbose 'PropertyProvider' opID=D935FB67-0000006E-b8] RecordOp ASSIGN: info.state, task-45062
vpxa-205.log:[2011-04-11 11:07:44.854 F701CB90 verbose 'PropertyProvider' opID=D935FB67-0000006E-b8] RecordOp ASSIGN: info.cancelable, task-45062
vpxa-205.log:[2011-04-11 11:07:44.854 F701CB90 info 'App' opID=D935FB67-0000006E-b8] [VpxLRO] -- BEGIN task-45062 -- -- vpxapi.VpxaService.createVm -- 5239f0b1-2f5c-8f6a-a2c4-aa1114ef6178
vpxa-205.log:[2011-04-11 11:07:44.854 F701CB90 verbose 'App' opID=D935FB67-0000006E-b8] [VpxaDatastoreContext] Resolved URL sanfs://vmfs_uuid:4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx to localPath /vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx
:
:
pxa-205.log:[2011-04-11 11:07:46.813 F701CB90 verbose 'PropertyProvider' opID=D935FB67-0000006E-b8] RecordOp ASSIGN: info, task-45062
vpxa-205.log:[2011-04-11 11:07:46.813 F701CB90 trivia 'PropertyCollector' opID=D935FB67-0000006E-b8] TriggerProcessGUReqs: Session 5239f0b1-2f5c-8f6a-a2c4-aa1114ef6178
vpxa-205.log:[2011-04-11 11:07:46.813 F701CB90 info 'App' opID=D935FB67-0000006E-b8] [VpxLRO] -- FINISH task-45062 -- -- vpxapi.VpxaService.createVm -- 5239f0b1-2f5c-8f6a-a2c4-aa1114ef6178
When vCenter send the request, the ESX host itself has their own task ID, you can see in our case the task on the host was 45062, and the UUID of the session which was 5239f0b1-2f5c-8f6a-a2c4-aa1114ef6178
Hostd logs:
“grep -i D935FB67-0000006E-b8 /var/log/vmware/hostd-* | less”
Part of the logs’ output:
hostd-12.log:[2011-04-11 11:07:45.960 F5ADCB90 info 'TaskManager' opID=D935FB67-0000006E-b8] Task Created : haTask-ha-folder-vm-vim.Folder.createVm-179078
hostd-12.log:[2011-04-11 11:07:45.970 F5ADCB90 verbose 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000006E-b8] Enabling disk uuid for Windows 2008 VM
:
:
hostd-12.log:[2011-04-11 11:07:46.340 F558AB90 info 'DiskLib' opID=D935FB67-0000006E-b8] DISKLIB-LIB : CREATE: "/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmdk" -- vmfs capacity=4194304 (2 GB) adapter=lsilogic cowGran=0
hostd-12.log:[2011-04-11 11:07:46.410 F558AB90 info 'DiskLib' opID=D935FB67-0000006E-b8] DISKLIB-DSCPTR: "/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmdk" : creation successful.
:
:
hostd-12.log:[2011-04-11 11:07:46.435 F558AB90 verbose 'VmDiskMgr' opID=D935FB67-0000006E-b8] Disk created successfully.
:
:
hostd-12.log:[2011-04-11 11:07:46.445 F558AB90 info 'ha-eventmgr' opID=D935FB67-0000006E-b8] Event 60 : Assign a new instance UUID (5021b940-e1a5-bb6c-18ef-5b653290d94d) to
hostd-12.log:[2011-04-11 11:07:46.445 F558AB90 info 'HostsvcPlugin' opID=D935FB67-0000006E-b8] Lookupvm: World ID not set for VM 112
:
:
hostd-12.log:[2011-04-11 11:07:46.778 F558AB90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000006E-b8] State Transition (VM_STATE_INITIALIZING -> VM_STATE_OFF)
:
:
hostd-12.log:[2011-04-11 11:07:46.778 F558AB90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000006E-b8] Initialized virtual machine.
hostd-12.log:[2011-04-11 11:07:46.779 F558AB90 verbose 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000006E-b8] Create DONE: /vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx
hostd-12.log:[2011-04-11 11:07:46.786 F558AB90 info 'TaskManager' opID=D935FB67-0000006E-b8] Task Completed : haTask-ha-folder-vm-vim.Folder.createVm-179078 Status success
hostd-12.log:[2011-04-11 11:07:46.786 F558AB90 info 'ha-eventmgr' opID=D935FB67-0000006E-b8] Event 61 : Created virtual machine on bs-bcs-h137.bsl.vmware.com in ha-datacenter
hostd-12.log:[2011-04-11 11:07:46.786 F558AB90 verbose 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000006E-b8] Create worker thread completed successfully
We can see some details from hostd logs. We know the VM was a “Windows 2008 VM” we know the VMDK size for this VM was 2GB, we know the virtual SCSI controller is “lsilogic”
State Transition (VM_STATE_INITIALIZING -> VM_STATE_OFF)
This is the first time hostd have the record of the VM’s power state. And at the end, the “create worker” finished its job.
VM modifications (Edit setting on VM)
Three modifications done to the VM
Changed memory from size
Change vCPU count
Add a virtual NIC
We also start by locating the opID
“grep -i johnny-test /var/log/vmware/hostd-* | grep "vim.vm.ConfigSpec" | less”
We are using the key word “vim.vm.ConfigSpec” to find any changes to the VM
Log output:
hostd-12.log:[2011-04-11 11:08:23.647 F579CB90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000008F-35] Reconfigure: (vim.vm.ConfigSpec) {
hostd-12.log:[2011-04-11 11:08:45.954 F5508B90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-000000A2-e] Reconfigure: (vim.vm.ConfigSpec) {
hostd-12.log:[2011-04-11 11:09:22.018 F6350900 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-000000B9-32] Reconfigure: (vim.vm.ConfigSpec) {
Here are the 3 modifications that I performed on the VM, and we see 3 different opIDs
For the VM modification, the only useful log to us is hostd logs. From the first output, we know the log we need to look at is hostd-12.log. Let’s get to details
“less -RS hostd-12.log” now search for the opID “/D935FB67-0000008F-35”
What we are looking for is this section:
[2011-04-11 11:08:23.645 F579CB90 info 'TaskManager' opID=D935FB67-0000008F-35] Task Created : haTask-112-vim.VirtualMachine.reconfigure-179094
[2011-04-11 11:08:23.647 F579CB90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-0000008F-35] Reconfigure: (vim.vm.ConfigSpec) {
dynamicType =
changeVersion = "2011-04-11T15:07:46.665679Z",
name =
version =
uuid =
instanceUuid =
npivWorldWideNameType =
npivDesiredNodeWwns =
npivDesiredPortWwns =
npivTemporaryDisabled =
npivOnNonRdmDisks =
npivWorldWideNameOp =
locationId =
guestId =
alternateGuestName =
annotation =
files = (vim.vm.FileInfo) {
dynamicType =
vmPathName = "[]/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx",
snapshotDirectory =
suspendDirectory =
logDirectory =
},
tools = (vim.vm.ToolsConfigInfo) null,
flags = (vim.vm.FlagInfo) null,
consolePreferences = (vim.vm.ConsolePreferences) null,
powerOpInfo = (vim.vm.DefaultPowerOpInfo) null,
numCPUs =
memoryMB = 3072,
memoryHotAddEnabled =
cpuHotAddEnabled =
cpuHotRemoveEnabled =
cpuAllocation = (vim.ResourceAllocationInfo) null,
memoryAllocation = (vim.ResourceAllocationInfo) null,
cpuAffinity = (vim.vm.AffinityInfo) null,
memoryAffinity = (vim.vm.AffinityInfo) null,
networkShaper = (vim.vm.NetworkShaperInfo) null,
swapPlacement =
swapDirectory =
preserveSwapOnPowerOff =
bootOptions = (vim.vm.BootOptions) null,
vAppConfig = (vim.vApp.VmConfigSpec) null,
ftInfo = (vim.vm.FaultToleranceConfigInfo) null,
vAppConfigRemoved =
vAssertsEnabled =
changeTrackingEnabled =
What I did was changed the memory size from whatever was before to 3072 (3GB) and there was no change on any other components.
Now keep going with the second part:
“less -RS hostd-12.log” now search for the opID “/D935FB67-000000A2-e”
Let’s see the change:
[2011-04-11 11:08:45.952 F5508B90 info 'TaskManager' opID=D935FB67-000000A2-e] Task Created : haTask-112-vim.VirtualMachine.reconfigure-179103
[2011-04-11 11:08:45.954 F5508B90 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-000000A2-e] Reconfigure: (vim.vm.ConfigSpec) {
:
:
tools = (vim.vm.ToolsConfigInfo) null,
flags = (vim.vm.FlagInfo) null,
consolePreferences = (vim.vm.ConsolePreferences) null,
powerOpInfo = (vim.vm.DefaultPowerOpInfo) null,
numCPUs = 2,
memoryMB =
memoryHotAddEnabled =
cpuHotAddEnabled =
cpuHotRemoveEnabled =
cpuAllocation = (vim.ResourceAllocationInfo) null,
memoryAllocation = (vim.ResourceAllocationInfo) null,
cpuAffinity = (vim.vm.AffinityInfo) null,
memoryAffinity = (vim.vm.AffinityInfo) null,
networkShaper = (vim.vm.NetworkShaperInfo) null,
swapPlacement =
swapDirectory =
preserveSwapOnPowerOff =
bootOptions = (vim.vm.BootOptions) null,
vAppConfig = (vim.vApp.VmConfigSpec) null,
ftInfo = (vim.vm.FaultToleranceConfigInfo) null,
vAppConfigRemoved =
vAssertsEnabled =
changeTrackingEnabled =
In here, I changed the number of vCPUs from default 1 to 2.
The last part:
“less -RS hostd-12.log” now search for the opID “/D935FB67-000000B9-32”
[2011-04-11 11:09:22.016 F6350900 info 'TaskManager' opID=D935FB67-000000B9-32] Task Created : haTask-112-vim.VirtualMachine.reconfigure-179114
[2011-04-11 11:09:22.018 F6350900 info 'vm:/vmfs/volumes/4cc0989b-5f6597b4-5fa3-001b2132c111/Johnny-test/Johnny-test.vmx' opID=D935FB67-000000B9-32] Reconfigure: (vim.vm.ConfigSpec) {
:
:
tools = (vim.vm.ToolsConfigInfo) null,
flags = (vim.vm.FlagInfo) null,
consolePreferences = (vim.vm.ConsolePreferences) null,
powerOpInfo = (vim.vm.DefaultPowerOpInfo) null,
numCPUs =
memoryMB =
memoryHotAddEnabled =
cpuHotAddEnabled =
cpuHotRemoveEnabled =
deviceChange = (vim.vm.device.VirtualDeviceSpec) [
(vim.vm.device.VirtualDeviceSpec) {
dynamicType =
operation = "add",
fileOperation =
device = (vim.vm.device.VirtualE1000) {
dynamicType =
key = -100,
deviceInfo = (vim.Description) null,
backing = (vim.vm.device.VirtualEthernetCard.NetworkBackingInfo) {
dynamicType =
deviceName = "Virtual Machine Network",
useAutoDetect =
network =
inPassthroughMode =
},
connectable = (vim.vm.device.VirtualDevice.ConnectInfo) {
dynamicType =
startConnected = true,
allowGuestControl = true,
connected = true,
status =
},
controllerKey = 100,
unitNumber =
addressType = "Assigned",
macAddress = "00:50:56:a1:00:0a",
wakeOnLanEnabled = true,
},
}
],
cpuAllocation = (vim.ResourceAllocationInfo) null,
memoryAllocation = (vim.ResourceAllocationInfo) null,
cpuAffinity = (vim.vm.AffinityInfo) null,
memoryAffinity = (vim.vm.AffinityInfo) null,
networkShaper = (vim.vm.NetworkShaperInfo) null,
swapPlacement =
swapDirectory =
preserveSwapOnPowerOff =
bootOptions = (vim.vm.BootOptions) null,
vAppConfig = (vim.vApp.VmConfigSpec) null,
ftInfo = (vim.vm.FaultToleranceConfigInfo) null,
vAppConfigRemoved =
vAssertsEnabled =
changeTrackingEnabled =
Ok, I think you got the idea, here is the virtual NIC added to this VM with assigned mac address and settings.
You can use the opID to filter vpxa and vpxd logs, but for what change was made, hostd is the place you want to look into.