Debug Log Reporting
Debugging log report output is controlled by the debug logging settings in Tenable Nessus. Review the debugging log files related to the specific credential being used, when troubleshooting scans with the VMware vCenter API or VMware ESX SOAP API integration.
Note: Plugin debugging for VMware is not centralized in a single log. The vCenter path writes to a per-collection-host debug log, while the ESXi SOAP path writes separate logs per feature (VIBs, active VMs, inactive VMs). ESXi SOAP API authentication occurs in each of those, so check all of them when troubleshooting a standalone ESXi scan.
vCenter authentication and data collection
| Path | Debug log |
|---|---|
| vCenter REST API (7.0.3+) | vmware_vcenter_collect.nbin~Collection_host |
| vCenter SOAP API (earlier than 7.0.3) | vmware_vcenter_collect_legacy.nbin~Collection_host |
The Collection_host is the IP address or FQDN of the host the collection was executed on, which happens only once per scan. These logs contain all aspects of data collection: authentication, retrieval of all ESXi hosts managed by the vCenter, VIBs installed for each ESXi host, virtual machines hosted on each ESXi host, and virtual machine details.
ESXi SOAP API logs
| Data collected | Debug log |
|---|---|
| ESXi installed VIBs | vmware_installed_vibs.log |
| ESXi active virtual machines | vmware_active_vms.log |
| ESXi inactive virtual machines | vmware_inactive_vms.log |
| Compliance checks | vmware_compliance_check.log, vmware_compliance_check_debug.log |
Caution: Do not use the debug logs for VMware vCenter Detect (63061) or VMware vSphere Detect (57396) — including vmware_vsphere_detect.log — to diagnose authentication problems. These plugins always send unauthenticated calls, so their logs can be misleading and do not represent authentication success or failure.
What the logs contain
The debug logs record the full integration lifecycle for each scan, including:
-
Configuration settings loaded from the scan policy (with sensitive values masked).
-
The authentication method used and whether authentication succeeded.
-
The VMware vCenter API requests and the HTTP response status.
-
Details on host(s), virtual machine, and VIBs collection.
-
Any errors returned by the VMware vCenter API, including authentication failures.
Common causes of Credentialed Checks: no on an ESXi host
-
Authentication to the vCenter API failed, so no data was retrieved.
-
The host was not returned as a managed ESXi host for the vCenter server in the credential, so VIBs were not retrieved for it.
-
The host is managed by vCenter, but the request to collect VIBs for that specific host returned an error — commonly a permissions problem on VMware vSphere Lifecycle Manager.
-
Verify SSL Certificate is enabled in the scan policy while the vCenter server presents a self-signed certificate.
-
The environment is a mixed-version deployment in which the REST API is unavailable on some hosts.