Red Hat Virtualization features the xend daemon and qemu-dm process, two utilities that write the multiple log files to the /var/log/xen/ directory:
xend.log is the logfile that contains all the data collected by the xend daemon, whether it is a normal system event, or an operator initiated action. All virtual machine operations (such as create, shutdown, destroy, etc.) appears here. The xend.log is usually the first place to look when you track down event or performance problems. It contains detailed entries and conditions of the error messages.
xend-debug.log is the logfile that contains records of event errors from xend and the Virtualization subsystems (such as framebuffer, Python scripts, etc.).
xen-hotplug-log is the logfile that contains data from hotplug events. If a device or a network script does not come online, the event appears here.
qemu-dm.[PID].log is the logfile created by the qemu-dm process for each fully virtualized guest. When using this logfile, you must retrieve the given qemu-dm process PID, by using the ps command to examine process arguments to isolate the qemu-dm process on the virtual machine. Note that you must replace the [PID] symbol with the actual PID qemu-dm process.
If you encounter any errors with the Virtual Machine Manager, you can review the generated data in the virt-manager.log file that resides in the /.virt-manager directory. Note that every time you start the Virtual Machine Manager, it overwrites the existing logfile contents. Make sure to backup the virt-manager.log file, before you restart the Virtual Machine manager after a system error.