We all know how we can set the correct time in ESX and in ESXi. It’s quite simple, just right click the host, go to the configuration tab. There you select “Time configuration” and “properties”.Â Â The configuration screen that appears is self-explanatory and after entering the NTP server addresses you are up and running.Â Â Now on every subsequent connection you make, you will see that the correct local time is displayed.
The strange thing I found when testing a nice appliance is that internally ESXi still uses UTC time.Â Â This appliance is called PhpLogCon, it receives syslogs from a number of systems and merges them into one log. You can then filter on events, hosts, etc. I have my ESXi host and my router logging to it.Â Â For now it works great.
However, what I noticed was that the log entries from ESXi were one hour off, after a little investigation and some help from @svenh, I found that ESXi always runs in UTC time internally and therefore the logs have the UTC time stamp to.Â for a little more information on thisÂ visit this post in the VMware Community.
So,Â ESXi will always run in UTC time.Â Â Now, is this a problem?Â Â The first issue to think of is, VM time sync, will Guests that are set to sync time with their host be one hour off? Hmmm… nope, because under the covers ESX also does it’s time keeping in UTC time,Â it just displays it to you in yourÂ preferred time zone.Â Â So if a VM running on ESX / ESXi asks the host about the correct time, the host will always return UTC time and the VM will calculate the correct time based on it’s own time zone, ie. how many hours to add or subtract.Â Â So for guest OS’s there shouldn’t be a problem.Â That also includes Active Directory Domain Controllers.
There is however, an issue when you start using the internal logs of ESXi.Â As already stated, I’m allowing ESXi to output all syslogs to the a fore mentioned appliance I am testing. Â In this appliance the logs show up with the “wrong” time stamp ie. UTC not my timezone.Â Therefore if using these logs to troubleshoot a problem, one would have to be careful to first align the ESXi logs with the logs from other systems, like SAN, routers, Windows, etc. Â I often have to wade through the vmkernel logs of ESX hosts at work (sad I know, but there is not much else to do), to find related entries whenever there was an issue and if their time would be off for one or more hours, it would make things a little more difficult.
I would love to hear remarks from other professionals in the field on this, are there situations in which you foresee problems?Â Would you have simple solutions to my “issue”?Â Would anyone know what time stamp is on SNMP traps from ESXi and how this is interpreted by the management systems?
- ESXi doesn’t have a /var/log/vmkernel anymore, they have merged in to /var/log/messages
- To redirect output of the syslogs to an external system: Connect with the VI Client to the host, go to configuration tab, advanced settings, Syslog -> remote and enter the IP of the remote host in Syslog.Remote.Hostname
- Thanks to Tom Howarth for reviewing this post.