I have been updating my vCenters to 5.5u3 in order to address a vulnerability described in VMSA-2015-0007. I finally hit my two largest vCenters, and I started to run into various issues. One vCenter wouldn’t update the web client and the other finished updating but had a lot of issues after rebooting. After some troubleshooting with support, I decided to roll back to the snapshot that I took.
Unfortunately, for the latter vCenter, the VMs were hosted in the same vCenter and I could not find the host that the VMs resided on (I knew before the change, but DRS kicked in once it came back up and moved it). A thought popped into my mind that Log Insight may know where this VM is (or the host that is resides on would report messages with that name on it).
In Log Insight, I searched for the “hostname” not starting with the vCenter VM name and the “vmw_esxi_vm_name” starts with the name of the vCenter vm. I grouped the result by hostname
In the above image, you can see that that there was one host that was reporting anything about the VM (host 12). You may need to change the search timeframe to the previous hour in order to see something. You also may see multiple hosts reporting, that may be due to a vMotion or possibly from the master HA node in addition to the actual host reporting something related to the VM.
Best of all is that Log Insight can create a shortened url for this query so that you can ALWAYS have it handy. I plan on creating these urls for all of my vCenters so that I can put it into a document for easy reference.