Had to troubleshoot an ESXi host reboot today. Came across this link – good one.
Here’s what I did though after the host reboot.
Once the host was online I connected to it via the vSphere client. I didn’t connect to the host directly (though you can do that too). I connected to the vCenter, then navigated to that host, went to the File menu and exported the system logs.
This creates a zip file containing another archive. I extracted the contents of this into a folder. The root of that folder has the usual Linux filesystem structure.
I went into the var folder here. (The log subfolder has many logs but most of these might be from after the reboot. If that’s the case, check the run/log subfolder).
In my case the /var/log/vmksummary.log file had entries for when the host rebooted. None of the other files mentioned anything.
|
1 2 |
2016-04-12T16:07:27Z bootstop: Host is rebooting 2016-04-12T16:13:38Z bootstop: Host has booted |
Then I went to the /var/run/log folder via PowerShell and ran a grep for the word reboot –
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
hostd.log:--> eventTypeId = "esx.audit.dcui.host.reboot", hostd.log:2016-04-12T16:03:08.762Z [27603B90 info 'Vimsvc.ha-eventmgr'] Event 19797 : The host is being rebooted through the Direct Console User Interface (DCUI). Please consult EXi Embedded and vCenter Server Setup Guide or follow the Ask VMware link for more information. hostd.log:--> eventTypeId = "esx.audit.host.stop.reboot", hostd.log:2016-04-12T16:07:27.658Z [28580B90 info 'Vimsvc.ha-eventmgr'] Event 19853 : Host is rebooting. hostd.log:2016-04-12T16:13:40.236Z [FFA99D20 verbose 'Solo.VmwareCLI'] Command reboot (reboot) hostd.log:2016-04-12T16:13:40.237Z [FFA99D20 error 'Solo.VmwareCLI'] Creating Command CLIInfo for reboot (reboot) hostd.log:2016-04-12T16:13:48.926Z [FFA99D20 info 'TagExtractor'] 8: Rule type=[N5Hostd6Common31MethodNameBasedTagExtractorRuleE:0xe132a28], id=rule[VMFoundryOpRule], tag=IsVMFounryOp, regex=vim\.VirtualMachine\.(acquireMksTicket|lone|createSecondary|createSnapshot|customize|disableSecondary|enableSecondary|makePrimary|migrate|mountToolsInstaller|powerOff|powerOn|rebootGuest|reconfigure|reload|reloadFromPath|relocate|removeAllSnapshots|turnOffFaultTolerance|recommendHostsForSecondaryVm|rename|reset|resetGuestInformation|retrieveScrenshot|revertToCurrentSnapshot|revertToSnapshot|screenshot|setScreenResolution|shutdownGuest|standbyGuest|startRecording|startReplaying|stopRecording|stopReplaying|suspend|terminae|terminateFaultTolerantVM|unmountToolsInstaller|unregister|upgradeTools|upgradeVirtualHardware) - Identifies Virtual Machine operations involving foundry vmksummary.log:2015-11-25T14:45:41Z bootstop: Host is rebooting vmksummary.log:2016-04-12T16:07:27Z bootstop: Host is rebooting vobd.log:2016-04-12T16:03:08.760Z: [GenericCorrelator] 12013972597248us: [vob.user.dcui.reboot.host] Rebooting host vobd.log:2016-04-12T16:03:08.760Z: [UserLevelCorrelator] 12013972597248us: [vob.user.dcui.reboot.host] Rebooting host vobd.log:2016-04-12T16:03:08.760Z: [UserLevelCorrelator] 12013972597598us: [esx.audit.dcui.host.reboot] The host is being rebooted through Direct Console User Interface(DCUI). Plese consult ESXi Embedded and vCenter Server Setup Guide or follow the Ask VMware link for more information. vobd.log:2016-04-12T16:07:27.657Z: [GenericCorrelator] 12014231494040us: [vob.user.host.stop.reboot] Host is rebooting. vobd.log:2016-04-12T16:07:27.657Z: [UserLevelCorrelator] 12014231494040us: [vob.user.host.stop.reboot] Host is rebooting. vobd.log:2016-04-12T16:07:27.657Z: [UserLevelCorrelator] 12014231494431us: [esx.audit.host.stop.reboot] Host is rebooting. |
Lots of messages indicating that the host was rebooted via the DCUI (lines 2, 4, 5, and 12). Thus I realized someone had manually rebooted the host.