Auditing ESXi Shell logins and commands in ESXi 5.x (History of executed commands in ESXi)

ESXi maintains a history of all commands entered in the ESXi Shell. This shell command history is maintained in the shell.logfile. Within the transcription of commands, the command issuer is identified only by the process or world ID, rather than by username or client address. This article describes how to correlate authentication information from the auth.log file with the history of commands executed in the ESXi Shell.

For more information on the locations of the log files described, see Location of ESXi 5.0 log files (2004201) and Location of log files for VMware products (1021806).

Procedure

To determine the commands executed in the ESXi Shell, and which user and client issued the request:

1. Obtain access to the auth.log and shell.log log files.
   
   • Log in to the ESXi Shell, and open each log using the less command.
   • Use a web browser to access https://ESXiHostnameOrIP/host/auth.log andhttps://ESXiHostnameOrIP/host/shell.log.
   • Use the vifs command line utility in the vCLI to copy the logs to a client, and review them there.
   • Read the files from within a vm-support log bundle.
     
2. Open the log file /var/log/auth.log in a text viewer.
   
3. Identify the authentication record, including the Username, Timestamp, and World ID for the session:
   
   
   • ESXi Shell login at the console appears similar to:
     
     2011-08-29T18:01:00Z login[64386]: root login on 'char/tty/1'
     
   • ESXi Shell login via interactive SSH appears similar to:
     
     2011-08-29T18:01:00Z sshd[12345]: Connection from 10.11.12.13 port 2605
2011-08-29T18:01:00Z sshd[12345]: Accepted keyboard-interactive/pam for root from10.11.12.13 port 2605 ssh22011-08-29T18:01:00Z sshd[64386]: Session opened for 'root' on /dev/char/pty/t02011-08-29T18:01:00Z sshd[12345]: Session closed for 'root' on /dev/char/pty/t0
...
2011-08-29T18:35:05Z sshd[12345]: Session closed for 'root' 2
     
   • ESXi Shell login via SSH with public key appears similar to:
     
     2011-08-29T18:01:00Z sshd[12345]: Connection from 10.11.12.13 port 2605
2011-08-29T18:01:00Z sshd[12345]: Accepted publickey for root from 10.11.12.13 port 2605ssh22011-08-29T18:01:00Z sshd[64386]: Session opened for 'root' on /dev/char/pty/t02011-08-29T18:01:00Z sshd[12345]: Session closed for 'root' on /dev/char/pty/t0
...
2011-08-29T18:35:05Z sshd[12345]: Session closed for 'root' 2
   
   Each of these authentication records indicate a successful authentication for the user root on August 29th at 18:01 GMT. The SSH methods also include the IP address tha the connection was initated from. The shell session is being handled by world 64386.
   
4. Close the log file /var/log/auth.log.
   
5. Open the log file /var/log/shell.log in a text editor or viewer.
   
6. Identify commands entered which contain the same World ID as identified in Step 3, appearing similar to:
   
   2011-08-29T18:01:01Z shell[64386]: Interactive shell session started2011-08-29T18:05:02Z shell[64386]: cd /var/log
2011-08-29T18:05:03Z shell[64386]: ls
2011-08-29T18:13:04Z shell[64386]: vmware -v
2011-08-29T18:35:05Z shell[64386]: exit
   
   Since the commands were entered in the console session handled by world ID 64386, we know that they correspond to the authentication session established by user root as described in Step 3.

Source:- http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2004810

Enabling FT on VM under nested ESXi 5 host

Note:- this article is Only for test and learning purpose not for production...

For test and development you can host esxi as a Nested VM and create HA/DRS cluster in that. But if you want to use FT in that scenario you need to 3 extra parameter under configuration parameters option 

 

Then you need three row  replay.supported true  replay.allowBTOnly true, replay.allowFT true after adding this it look like see the snap below:-

After adding the rows you can click ok and then again ok, now if all other requirement of FT are configured you can enable the FT on VM even this is running on nested esxi host.

Virtual Machine Swap file size (.vswp)

Swap File Size Calculation

Every VM have some amount of Memory configured. So when we power on the VM, vmkernel have to create the Swap file for VM (this file is different file than vmdk file), so that in case of memory contention overallocated memory can be delivered (in the storage there must be free space available to create that file otherwise we can't power on the VM).

Swap File is calculated using the below formula:-

Allocated Memory to VM - Reserve Memory to VM = Size of Swap file (.vswp)

Suppose VM is configure with 2048 MB of Memory and Reserve for that VM is 512 MB then swap file size is 1536 MB as per above formula:-

2048 - 512 = 1536 MB.

Even you reserve 100 % allocated memory to VM swap file still created but with 0KB in size.

Swap file created even you have enough memory on host, but vmkernel only use this file (in case of memory contention)  if demand of memory is more than the available amount of Memory on Host (ESXi).

Deploying and Configuring vCenter Appliance

Host Profile

What is Host Profile ?

The host profiles feature creates a profile that encapsulates the host configuration and helps to manage the host configuration, especially in environments where an administrator manages more than one host or cluster in vCenter Server.

Host profiles eliminates per-host, manual, or UI-based host configuration and maintains configuration consistency and correctness across the datacenter by using host profile policies. These policies capture the  blueprint of a known, validated reference host configuration and use this to configure networking, storage, security, and other settings on multiple hosts or clusters. You can then check a host or cluster against a profile’s configuration for any deviations.

How to Use Host Profile ?

You perform host profiles tasks in a certain workflow order.

You must have an existing vSphere installation with at least one properly configured host.

•  Set up and configure the host that will be used as the reference host.
•  A reference host is the host from which the profile is created.
• Create a profile using the designated reference host.
• Attach a host or cluster to the profile.
• Check the host's compliance to the reference host's profile. If all hosts are compliant with the  reference host, they are correctly configured.
• Apply the host profile of the reference host to other hosts or clusters of hosts (Host need to be in maintenance mode to apply the profile).

Note:- Using host profiles is only supported for VMware vSphere 4.0 hosts or later

Creating a Host Profile

You create a new host profile by using the designated reference host's configuration.

A host profile can be created from:

•  Host Profile main view
•  Host's context menu

Create a Host Profile from Host Profiles View

You can create a host profile from the Host Profiles main view using the configuration of an existing host.

Prerequisites

You must have a vSphere installation and at least one properly configured host in the inventory.

Procedure

1 In the Host Profiles main view, click Create Profile.The Create Profile wizard appears.

2 Select the option to create a new profile and click Next.

3 Select the host you want to designate as the reference host for the new host profile and click Next.

   The reference host must be a valid host.

4 Type the name and enter a description for the new profile and click Next.

5 Review the summary information for the new profile and click Finish to complete creating the     

  profile. The new profile appears in the profile list.

  

Create a Host Profile from Host

You can create a new host profile from the host's context menu in the Hosts and Clusters inventory view.

Prerequisites

You must have a vSphere installation and at least one properly configured host in the inventory.

Procedure

1 In the Host and Clusters view, select the host that you want to designate as the reference host for   

   the new host profile. The host must be a valid host to use as a reference host.

2 Right-click the host and select Host Profile > Create Profile from Host

    The Create Profile from Host wizard opens.

3 Type the name and enter a description for the new profile and click Next.

4 Review the summary information for the new profile and click Finish to complete creating the     

    profile. The new profile appears in the host's Summary tab.

Attach Profiles from the Host

Before you can apply the profile to a host you need to attach the host to the profile or the profile to the host. You can attach a profile to a host from the host's context menu in the Hosts and Clusters inventory view. When a host profile is attached to a cluster, the host or hosts within that cluster are also attached to the host profile. However, when the host profile is detached from the cluster, the association between the host or host within the cluster and that host profile remain.

Procedure

1 In the Host and Clusters view, select the host to which you want to attach a profile.

2 Right-click the host and select Host Profile > Manage Profile.

   NOTE   If no host profiles exist in your inventory, a dialog appears asking if you want to create   
   and attach the host to this profile.

3 In the Attach Profile dialog, select the profile to attach to the host and click OK.

   The host profile is updated in the Summary tab of the host.

Apply a Profile from the Host

You can apply a profile to a host from the host's context menu.

Prerequisites

The host must be in maintenance mode before a profile is applied to it.

Procedure

1 In the Host and Clusters view, select the host to which you want to apply a profile.

2 Right-click the host and select Host Profile > Apply Profile.

3 In the Profile Editor, enter the parameters and click Next.

4 Continue until all the required parameters are entered.

5 Click Finish.

Compliance Status is updated.

For more details:-
http://pubs.vmware.com/vsphere-50/topic/com.vmware.ICbase/PDF/vsphere-esxi-vcenter-server-50-host-profiles-guide.pdf

How to change Virtual Machine Snapshot files location (vSphere 5)

I have taken an example, I have created two datastore like below:-

VM-Datastore dedicated for VM related files like vmx,vmdk etc

Snapshot-Datastore dedicated for VM Snapshot  files like vmsn, delta.vmdk etc.

If you want to change the snapshot files location for different datastore than default, you need to shut down the VM first. Then remove the VM from inventory, and then use esxi Local Shell or SSH Shell and edit the .vmx file of that VM with vi editor and add the lines at the end of the file:- 

Snapshot.redoNotWithParent = “true”

workingDir  = “Location of your datastore”    like see the snapshot below:-

After this save the file and add the VM to inventory back using the vSphere client. When you power on the VM, and after this you will take snapshot the snapshot, files will created under the defined datastore. You can browse and confirm the snapshot file  are under the new datastore like:-

So now snapshot files location is as per your requirement.

How to change Virtual Machine swap file location VMware ESXi

I have taken an example, I have created two datastore like below:-

VM-Datastore dedicated for VM related files like vmx,vmdk etc

Swap-Datastore dedicated for VM Swap files.

If you want to change the swap file location to different datastore than default, you need to shut down the VM first. Once VM is offline then go to Edit Setting of that VM and then click on Options tab like see the screenshot below:-

Then click on Configure Parameters  button. Then you’ll get another window like below and then you need to click on add row button :-

Under the name filed you need to type “sched.swap.dir” and in the value field you need to type the path of datastore where you want swap files. Like in my case I have dedicated datastore for Swap files, so I have defined the path “/vmfs/volumes/Swap-Datastore” and the click on OK

After that when you powered in that VM the swap file get created under new datastore. You can browse and confirm thenswap file is under this like:-

So now swap file location is as per your requirement.