Browsed by
Category: vCSA

Getting Support Log Bundle using REST API

Getting Support Log Bundle using REST API

Starting from vSphere 7U1 we have got a new tool to generate and download a support log bundle from vCenter Server. It is REST API call used to achieve these tasks. It broadens an already wide range of methods of gathering vm-support log bundle. It has several interesting features.

First, it works even if the vCSA service is offline, whereas a vCSA management interface should be up and running.

Second, once started it generates a support bundle and stores it on vCSA disk. A downloaded bundle is deleted after 30 minutes. As you know, even in a small vSphere environment downloading a log bundle could be time consuming, therefor, if a generated bundle download task is in progress, the bundle deletion will be postponed for 30 minutes.

To be able to use this new method a user authenticated in SSO must be a member of a new SSO group – SystemConfiguration.SupportUsers. Users belonging to this group are entitled only to call support bundle REST API. They don’t have any other privileges to the environment. SSO Administrator role is a member of this group by default.

Now, let’s play with the API calls.

To enumerate every component which is gathered by support bundle REST API, you can use the following GET command:

GET https://vcsa_fqdn:5480/rest/appliance/support-bundle/components

To generate a bundle you can use this POST statement:

POST https://vcsa_fqdn:5480/rest/appliance/support-bundle?action=create&vmw-task=True

This statement takes a few parameters:

  • Description – A text description of a the started task
  • Components (optional) – You can provide a list of previously listed components. If you leave this parameter empty, then logs from all components will be gathered.
  • Partition (optional) – You can define a place where generated log bundle will be stored, for example /storage/core. If you leave it blank, a default storage location (/storage/log) will be used.

This statement will return a task ID. You can use this task ID to get the information about a status of a task.

To return the status of a task you have started, issue this command providing a task ID at the end:

GET https://vcsa_fqdn:5480/rest/cis/tasks/<task-id>

If you need more detailed information, use this command to return the complete information about the generation task:

GET https://vcsa_fqdn:5480/rest/appliance/support-bundle

You will get all the information (description, status, generation time, expiration time, bundle size) including URL, which you can use to download the generated support bundle.

If the support bundle REST API fails, you will be informed with an error message providing information about a failure reason.

I recommend using Postman to issue these commands because you can prepare an Environment, a Collection, named for example vCSA Support Bundle where you can store the commands above mentioned. You can use curl as well, if it’s your favourite multi-tool.

VCSA Tools – Part 1 – journalctl. Better way for vCSA log revision.

VCSA Tools – Part 1 – journalctl. Better way for vCSA log revision.

There’s a plenty of great CLI tools in VCSA that modern vSphere administrator should know, so I decided to share my knowledge and describe them in the series of articles.

The first one is journalctl. A tool that simplifies and quickens the VCSA troubleshooting process.

Below I’m presenting how I’m using it, to filter the logs records.

Log in to VCSA shell and run the commands below, regarding to the result you want to achive.

The logs from the current boot:

journalctl -b

The boots that journald is aware of:

journalctl --list-boots

It will show this kind of results representing each known boot:

-3 26c7f0e356eb4d0bbd8d9fad1b457808 Wed 2019-01-09 15:18:12 UTC—Wed 2019-01-09 16:58:18 UTC
-2 124d73cf46d441908db7609813e0c49a Wed 2019-01-09 17:01:08 UTC—Fri 2019-01-11 10:22:39 UTC
-1 ebf1ba1936404fb086727b61ac825d47 Fri 2019-01-11 11:22:59 UTC—Fri 2019-01-11 15:48:37 UTC
 0 bd70a6d99a7245dc9b7859c5f2a7ef6f Mon 2019-01-14 10:19:47 UTC—Tue 2019-01-15 12:38:16 UTC

Now you can use it, to display the results of the chosen boot:

journalctl -b -1

To limit the results to the given timeframe, use dates or keywords:

journalctl --since "2019-01-10" --until "2019-01-14 03:00"


journalctl --since yesterday


journalctl --since 09:00 --until "2 hour ago"

Limiting the logs by service name:

Get the service names first:

systemctl list-unit-files | grep -i vmware

To show only records for vpxd service in current boot:

journalctl -b -u vmware-vpxd.service

Filtering by Id (Process, User or Group):

Get the user Id, e.g.:

cat /etc/passwd | grep -i updatemgr


journalctl _UID=1017 --since today

Filtering by the binary path:

journalctl -b --since "20 minute ago" /usr/sbin/vpxd

Displaying kernel messages:

journalctl -k

Limiting messages by their priorities:

journalctl -p err -b

where the priority codes are:

0: emerg
1: alert
2: crit
3: err
4: warning
5: notice
6: info
7: debug

Of course those examples don’t exhaust all the possibilities this tool has, but consider them as a usage starting point. Feel free to add new, useful examples in comments below.

That’s all for today!