At work I’ve start to manage an existing vmware cluster. One of the first things I did was to setup a common syslog platform and send all the messages from the ESXi servers to it.
The syslogs messages from vmware are prefixed with process ID which identifies what process the syslogs relate to. The format of the syslog is:
So far I’ve been able to identify the following processes and their usefulness.
|Low||VPXD||It is Vcenter Server Service. If this service is stopped then we will not able to connect to Vcenter Server via Vsphere client.|
|Low||VPXA||It is the agent of Vcenter server. also known as mini vcenter server which is installed on the each esx server which is managed by Vcenter server. What are the management action we are performing on top of the vcenter server. (Like:- Increasing/Decreasing RAM & HDD, Making any type of changes in cluster,doing vmotion. This agent collects all information from the vcenter server and pass this information to the kernal of the esx server)|
|Low||HOSTD||This is the agent of ESX server, here VPXA pass the information to the HOSTD and hostd pass the information to ESX server.|
|Medium||vmkernel||Core VMkernel logs, including device discovery, storage and networking device and driver events, and virtual machine startup.|
|High||vmkwarning||selected error messages from vmkernel|
|Fdm||vSphere High Availability logs, produced by the fdm service.|
|High||vobd||vob propagates kernel level errors to third-party applications. vobd is a daemon that VMware and third-party applications use for monitoring and troubleshooting.|
|Low||crond||standard cron messages|
|High||heartbeat||Awesome, a quick summary of ESXi host startup and shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption. For more information, see Format of the ESXi 5.0 vmksummary log file (2004566).|
|Low||cimslp||CIM (Common Information Model) SLP (Service Location Protocol)|