VMware ESXi Log Collection (vm-support)
The VMware ESXi host system log bundle (vm-support bundle) is used to analyze issues such as host crashes (purple screen PSOD), storage paths, and drivers. If the issue relates to server hardware, you must also collect hardware logs from the server management interface (e.g., Dell iDRAC TSR/SEL, Lenovo XCC FFDC).
Method 1: Export via vSphere Client
Connect to the host using vSphere Client (or vCenter), select File → Export → Export System Logs.
- Select the host and log scope to export, specify the local save directory, and wait for the zip file to be generated.
Menu locations differ by client version. In newer clients, select the host and use Export System Logs or Generate support bundle.
Method 2: Generate via host command line
After enabling the ESXi Shell or SSH, log in as root and execute:
vm-support
# Choose a datastore with sufficient free space when specifying the output directory:
vm-support -w /vmfs/volumes/datastore1The command reports the generated esx-HostName-Date.tgz archive location. The original guide names /var/tmp; Broadcom documents that the default location depends on the available filesystem and free space. Read the command output, or specify a destination with -w.
Use tools such as WinSCP to retrieve the generated .tgz file.
Supplement: Hardware logs for Dell servers (SEL)
For hardware-related issues, you must also provide the System Event Log from iDRAC.
Command line: Use
telnet -f d:\rac.log <iDRAC IP>(or start a session recording via an SSH client) to log in to iDRAC and executeracadm racdump(orracadm getsel), then exit and sendrac.log.Web page: Log in to iDRAC, go to the 'System Event Log' page, and click 'Save As' to save.
Localized iDRAC6 example. System → Logs → System Event Log → Save As exports SEL; avoid Clear Log when collecting evidence.
For Dell 12G and later servers, a TSR/SupportAssist collection includes SEL. Provide that hardware bundle alongside the ESXi logs; see the Dell PowerEdge TSR (SupportAssist) collection guide.