ESXi Log files location and their description.

Below is the compiled list of ESXi log files location and their description.

Log File	Persistent Location	Description
/var/log/auth.log	/scratch/log/auth.log	ESXi Shell authentication information such as success and failures.
/var/log/dhclient	/scratch/log/dhclient.log	DHCP client log, including discovery, address lease requests and renewals.
/var/log/esxupdate	/scratch/log/esxupdate.log	ESXi patch and update logs (useful if you need to know why a patch failed).
/var/log/hostd.log	/scratch/log/hostd.log	Host management service logs includes virtual machine and ESXi host task and events, communication with the vSphere Client and VMware vCenter Server vpxa agent, and SDK connections.
/var/log/shell.log	/scratch/log/shell.log	ESXi shell usage logs that track commands that were run. ESXi shell usage logs include enable/disable, and every command entered.
/var/log/sysboot.log		VMkernel startup and module loading.
/var/log/boot.gz		A compressed file that contains boot log information. Can be read without unzipping, by using zcat.
/var/log/syslog.log	/scratch/log/syslog.log	Management service initialization, watchdogs, scheduled tasks and DCUI use.
/var/log/usb.log	/scratch/log/usb.log	USB device information such as discovery and pass-through to virtual machines.
/var/log/vobd.log	/scratch/log/vobd.log	VMkernel observation events. VOBD is a daemon that VMware and third-party applications use for monitoring and troubleshooting.
/var/log/vmkernel	/scratch/log/vmkernel.log	Core VMkernel logs, including device discovery, storage and networking device and driver information, and virtual machine startup information and driver events.
/var/log/vmkwarning	/scratch/log/vmkwarning.	A summary of warnings and alert log messages excerpted from the VMkernel logs.
/var/log/vmksummary	/scratch/log/vmksummary.	ESXi host startup/shutdown, and an hourly heartbeat with uptime, number of virtual machines running, and service resource consumption.
/var/log/vpxa.log	/scratch/log/vpxa.log	Present when a host is connected to a vCenter Server. vCenter Server VPXA agent logs, including communication with vCenter Server and the host management hostd agent.
/var/log/fdm.log	/scratch/log/fdm.log	Present when a host is connected to a vCenter Server. VMware vSphere High Availability logs, produced by the fdm service.
/var/log/lacp.log	/scratch/log/lacp.log	Link aggregation control protocol logs. ESXi 5.1 onwards only.
/var/log/hostd-probe.log	/scratch/log/hostd-probe.log	Host management service responsiveness checker.
/var/log/rhttpproxy	/scratch/log/rhttpproxy.	HTTP connections proxied on behalf of other ESXi host web services.
/var/log/Xorg.log	/scratch/log/Xorg.log	Video acceleration.
/var/log/clomd.log	/scratch/log/clomd.log	CLOM daemon. Cluster level object manager (CLOM) logs. These logs are part of the VMware vSAN™ feature.
/var/log/esxcli.log
/var/log/osfsd.log	/scratch/log/osfsd.log	OSFSD daemon. Object storage file system (OSFS) logs. These logs are part of the vSAN feature.
/var/log/sdrsinjector.log	/scratch/log/sdrsinjector.log	VMware vSphere Storage DRS™ injector log. Profiles the capabilities of the datastores for vSphere Storage DRS.
/var/log/swapobjd	/scratch/log/swapobjd.log	SwapObj daemon logs.
/var/log/sysboot.log		Early VMkernel startup and module loading.
/var/log/vmamqpd.log		VMware AMQP daemon log.
/var/log/vmkeventd	/scratch/log/vmkeventd.log	Capture of VMkernel events.
/var/log/vprobe.log	/scratch/log/vprobe.log	Output of VMware VProbes™, which provides a facility for transparently instrumenting a powered-on guest operating system, its currently running processes, and VMware virtualization software.
/var/log/vsanvpd.log	/scratch/log/vsanvpd.log	vSAN logs.

---