Had to troubleshoot an ESXi host reboot today. Came across this link – good one.
Here’s what I did though after the host reboot.
Once the host was online I connected to it via the vSphere client. I didn’t connect to the host directly (though you can do that too). I connected to the vCenter, then navigated to that host, went to the
File menu and exported the system logs.
This creates a zip file containing another archive. I extracted the contents of this into a folder. The root of that folder has the usual Linux filesystem structure.
I went into the
var folder here. (The
log subfolder has many logs but most of these might be from after the reboot. If that’s the case, check the
In my case the
/var/log/vmksummary.log file had entries for when the host rebooted. None of the other files mentioned anything.
2016-04-12T16:07:27Z bootstop: Host is rebooting
2016-04-12T16:13:38Z bootstop: Host has booted
Then I went to the
/var/run/log folder via PowerShell and ran a
grep for the word reboot –
hostd.log:--> eventTypeId = "esx.audit.dcui.host.reboot",
hostd.log:--> eventTypeId = "esx.audit.host.stop.reboot",
hostd.log:2016-04-12T16:07:27.658Z [28580B90 info 'Vimsvc.ha-eventmgr'] Event 19853 : Host is rebooting.
hostd.log:2016-04-12T16:13:40.237Z [FFA99D20 error 'Solo.VmwareCLI'] Creating Command CLIInfo for reboot (reboot)
hostd.log:2016-04-12T16:13:48.926Z [FFA99D20 info 'TagExtractor'] 8: Rule type=[N5Hostd6Common31MethodNameBasedTagExtractorRuleE:0xe132a28], id=rule[VMFoundryOpRule], tag=IsVMFounryOp, regex=vim\.VirtualMachine\.(acquireMksTicket|lone|createSecondary|createSnapshot|customize|disableSecondary|enableSecondary|makePrimary|migrate|mountToolsInstaller|powerOff|powerOn|rebootGuest|reconfigure|reload|reloadFromPath|relocate|removeAllSnapshots|turnOffFaultTolerance|recommendHostsForSecondaryVm|rename|reset|resetGuestInformation|retrieveScrenshot|revertToCurrentSnapshot|revertToSnapshot|screenshot|setScreenResolution|shutdownGuest|standbyGuest|startRecording|startReplaying|stopRecording|stopReplaying|suspend|terminae|terminateFaultTolerantVM|unmountToolsInstaller|unregister|upgradeTools|upgradeVirtualHardware) - Identifies Virtual Machine operations involving foundry
vmksummary.log:2015-11-25T14:45:41Z bootstop: Host is rebooting
vmksummary.log:2016-04-12T16:07:27Z bootstop: Host is rebooting
vobd.log:2016-04-12T16:03:08.760Z: [GenericCorrelator] 12013972597248us: [vob.user.dcui.reboot.host] Rebooting host
vobd.log:2016-04-12T16:03:08.760Z: [UserLevelCorrelator] 12013972597248us: [vob.user.dcui.reboot.host] Rebooting host
vobd.log:2016-04-12T16:07:27.657Z: [GenericCorrelator] 12014231494040us: [vob.user.host.stop.reboot] Host is rebooting.
vobd.log:2016-04-12T16:07:27.657Z: [UserLevelCorrelator] 12014231494040us: [vob.user.host.stop.reboot] Host is rebooting.
vobd.log:2016-04-12T16:07:27.657Z: [UserLevelCorrelator] 12014231494431us: [esx.audit.host.stop.reboot] Host is rebooting.
Lots of messages indicating that the host was rebooted via the DCUI (lines 2, 4, 5, and 12). Thus I realized someone had manually rebooted the host.
Troubleshooting ESXi host reboots by rakhesh is licensed under a Creative Commons Attribution 4.0 International License.