Navigating VMware logs for troubleshooting

Finding VMware Horizon event log files

IT administrators rely on the VMware Horizon Administrator Console web interface to perform management tasks. When issues arise in the environment, it makes sense for VMware admins to look through the interface to find what they need. VMware recommends configuring a database for event logging.

If you have this log database in place, Horizon will store informational messages, warnings and error messages in that database. Those entries are found in the Events option in the menu (Figure 1).

Note the most recent events are at the top of this log. You can see an error message for a machine where the customization has failed on the fifth and sixth lines. This is the most convenient place to find such issues.

It is also possible to find those messages in the log files on the connection server. These logs may also contain more detailed information than just a simple error message. Additionally, there are issues that VMware Horizon flags in the log files, but that would not show up in the graphical web console. For example, the same message from the admin interface event log for the machine with the customization error would show up in the connection server (Figure 2).

In this case, the reason for the customization error is that the machine was not able to obtain an IP address. Therefore, the machine couldn't contact the domain controller. In this example, the log entry would not contain information about the root case, but that's the benefit of the more detailed troubleshooting logs.

A benefit of accessing the logs over the event database records is that you can send those logs to a centralized logging server. If you use VMware vRealize Log Insight, you can set the environment to trigger an alert when Horizon receives certain log entries. While this is not feasible for all VMware admins due to various factors such as licensing, it's certainly worth considering this automation.

VMware log file locations

All VMware products store log files on the individual machines and without centralized logging, you can always access them in those locations.

You can find log files in the most common locations for the given operating system. For Windows, that is in c:\programdata in a folder for your application. For Linux, in /var/log it lives either directly in that folder or a subdirectory for your application. However, log files are sometimes in unexpected locations, and it may be hard to find them.

VMware administrators have a useful central resource that allows you to find all log files for VMware products and services. VMware Horizon log files are available on each of the machines in the environment, including clients, agents and servers.

VMware Horizon connection server logs

Each connection server's log files live at C:\ProgramData\VMware\VDM\logs. By default, the connection servers only log informational messages. You can modify this logging level with a menu option in the start menu on the connection server (Figure 3).

This runs a batch file named support.bat, which is located at C:\Program Files\VMware\VMware View\Server\DCT with parameter loglevels. This opens a menu that prompts for the new log level (Figure 4).

Be aware that when you change the logging to Debug or Full, Horizon will generate more data, which can cause excessive resource use on your connection server. You should only increase the level when researching issues on the connection server. Don't forget to set the level back to informational when you are done with troubleshooting. 

Figure 5 shows an example of details from the log file on the connection server. A warning about a data store that is 96.58% full is highlighted in blue.

A debug message outlined in red in Figure 5 refers to a data store that is 36.25% full. When you investigate problems with Horizon not creating virtual machines, such messages can help you find the root cause of the problem.

The aforementioned support.bat batch file can also generate a log bundle on your connection server. It's also a shortcut in the server start menu, but this batch file is available on most Horizon machines. VMware support could ask for a log bundle when you open an incident with them because it contains the entire collection of configuration and log files, which the VMware support team can analyze. You could also extract that log bundle yourself because it allows you to go through the setup and logs.

This log file collection method and log bundle work with all versions of Horizon. It's especially useful for administrators running VMware Horizon 7. If you have upgraded to VMware Horizon 8, you have other options to access these logs.

VMware log files in virtual desktops

Virtual desktops and Remote Desktop Services (RDS) hosts with an existing Horizon agent store logs in C:\ProgramData\VMware\VDM\logs. You can find these logs there, but there's a helpful feature with the vdmadmin.exe utility that's available on the connection server in the following folder: C:\Program Files\VMware\VMware View\Server\bin\tools.

Running vdmadmin.exe -help -A shows the options for the Agent feature, which yields an output that contains helpful information (Figure 6).

For example, this output shows that you can download the complete log bundle with the following components: the -getlogfile parameter and the name of the machine the logfile for the current date, which you can retrieve with the -getDCT parameter.

This is useful because you can now access these files without interacting with the end user working from that virtual desktop.

VMware log files on Windows client computers

You can find the log files for computers running the Horizon Client on Windows in C:\Users\%username%\AppData\Local\VMware\VDM\Logs. These logs are in the user's local profile folder. Because the worker uses the client, you can't always spend much time on the machine itself to investigate logs. To avoid this, you can also collect an offline log bundle with support.bat located in C:\Program Files (x86)\VMware\VMware Horizon View Client\DCT. 

VMware log files in the Unified Access Gateway

The Unified Access Gateway runs in a Linux appliance. If you have root-level access to that machine, the logs for the application are at /opt/vmware/gateway/logs. You may not have that level of access, but there's an even more convenient way to access the machine directly from your administrative web interface. Under the Support Settings, there is a link to download a file named UAG-log-archive.zip (Figure 7).

That file contains all log files from the appliance that you can download for offline analysis. In this interface, you can also find the option to change the log level. You can set it from informational to debug level for when you investigate a problem in your environment. As always, don't forget to set it back to the standard setting when you're done to avoid excessive resource usage.

Collecting logs from the Horizon Console

Starting with Horizon 8 release in 2012 -- sometimes called 8.1 -- you can also retrieve logs for agents and connection servers from the Horizon Administrator Console. The option is under the Troubleshooting tab in the main Horizon menu. First, you must create a role with the necessary privileges -- such as an Agent type within the Marketing Pool -- before you can access this feature (Figure 8).

After assigning yourself the correct permissions, you can download the logs from a connection server, virtual desktops or RDS hosts.