Is it possible to SSH to a esxi host with a read only account?
Our security team wants to scan our ESXI hosts for vulnerabilities and their tool uses SSH. I dont want to give them an administrator account to do this but everything I have found says SSH only works with administrator accounts.
We have started to experience over the last couple of weeks our ESXi 6.5 U2 hosts becoming unresponsive after a time, they drop off from Virtual Center and the DUCI become unresponsive. The only method of access is through SSH, which is intern slow. The VM's on these hosts do continue to run for a time, and then themselves have performance issues where as the servers needed.
VMkernel logging shows the following;
/var/log/vmkernel.log -- pattern
2018-09-28T13:55:10.431Z cpu34:65677)[qedentv_multictx_remove_rx_rule:1534(vmnic7)]Removing mac:00:50:56:a1:57:00, vlan_id:0x0, from fp:1, op:MAC_DEL, hw_fn:0
2018-09-28T13:55:10.431Z cpu34:65677)[qedentv_multictx_set_rx_rule:1139(vmnic7)]Applying 00:50:56:a1:57:00 filter, vlan_id:0xffff, fp_id:0, hw_fn:0.
2018-09-28T13:55:10.431Z cpu34:65677)[qedentv_multictx_q_free:5068(vmnic7)]fp:1, is_last:0, qtype:RX, hw_fn:0
2018-09-28T13:55:20.431Z cpu25:65677)[qedentv_multictx_q_alloc:4641(vmnic7)]fp:1, feat:0x0, qtype:RX, hw_fn:0
2018-09-28T13:55:20.458Z cpu43:65677)[qedentv_multictx_remove_rx_rule:1534(vmnic7)]Removing mac:00:50:56:a1:57:00, vlan_id:0x0, from fp:0, op:MAC_DEL, hw_fn:0
2018-09-28T13:55:20.458Z cpu43:65677)[qedentv_multictx_set_rx_rule:1139(vmnic7)]Applying 00:50:56:a1:57:00 filter, vlan_id:0xffff, fp_id:1, hw_fn:0.
2018-09-28T13:55:24.431Z cpu45:65677)[qedentv_multictx_remove_rx_rule:1534(vmnic6)]Removing mac:00:50:56:a1:4d:77, vlan_id:0x0, from fp:1, op:MAC_DEL, hw_fn:0
2018-09-28T13:55:24.431Z cpu45:65677)[qedentv_multictx_set_rx_rule:1139(vmnic6)]Applying 00:50:56:a1:4d:77 filter, vlan_id:0xffff, fp_id:0, hw_fn:0.
2018-09-28T13:55:24.432Z cpu45:65677)[qedentv_multictx_q_free:5068(vmnic6)]fp:1, is_last:0, qtype:RX, hw_fn:0
2018-09-28T13:55:29.432Z cpu32:65677)[qedentv_multictx_q_alloc:4641(vmnic6)]fp:1, feat:0x0, qtype:RX, hw_fn:0
2018-09-28T13:55:29.457Z cpu24:65677)[qedentv_multictx_remove_rx_rule:1534(vmnic6)]Removing mac:00:50:56:a1:4d:77, vlan_id:0x0, from fp:0, op:MAC_DEL, hw_fn:0
2018-09-28T13:55:29.457Z cpu24:65677)[qedentv_multictx_set_rx_rule:1139(vmnic6)]Applying 00:50:56:a1:4d:77 filter, vlan_id:0xffff, fp_id:1, hw_fn:0.
localcli
# localcli network nic list
Name PCI Device Driver Admin Status Link Status Speed Duplex MAC Address MTU Description
-------------------------------------------------------------------------------------------------------------
vmnic0 0000:18:00.0 igbn Up Down 0 Half 24:6e:96:b7:e9:44 1500 Intel Corporation I350 Gigabit Network Connection
vmnic1 0000:18:00.1 igbn Up Down 0 Half 24:6e:96:b7:e9:45 1500 Intel Corporation I350 Gigabit Network Connection
vmnic2 0000:18:00.2 igbn Up Down 0 Half 24:6e:96:b7:e9:46 1500 Intel Corporation I350 Gigabit Network Connection
vmnic3 0000:18:00.3 igbn Up Down 0 Half 24:6e:96:b7:e9:47 1500 Intel Corporation I350 Gigabit Network Connection
vmnic4 0000:3b:00.0 qedentv Up Up 10000 Full f4:e9:d4:77:99:dc 9000 QLogic Corp. QLogic FastLinQ QL41xxx 1/10/25 GbE Ethernet Adapter
vmnic5 0000:3b:00.1 qedentv Up Up 10000 Full f4:e9:d4:77:99:dd 9000 QLogic Corp. QLogic FastLinQ QL41xxx 1/10/25 GbE Ethernet Adapter
vmnic6 0000:5e:00.0 qedentv Up Up 10000 Full f4:e9:d4:73:5c:4e 1500 QLogic Corp. QLogic FastLinQ QL41xxx 1/10/25 GbE Ethernet Adapter
vmnic7 0000:5e:00.1 qedentv Up Up 10000 Full f4:e9:d4:73:5c:4f 1500 QLogic Corp. QLogic FastLinQ QL41xxx 1/10/25 GbE Ethernet Adapter
I have been informed this could be a firmware/driver issue, however I want to see if any one in the community has had the issue.
Thanks
Tristan
Hi,
This question still pop up from customers about the right ratio. For some case the customer would prefer to have 1:1 relation between vCPU and pCPU. MY understand it can depend on CPU clock cycle more than the number of cores. Will the highs clock cycle will expose less ready time and CPU contention ? Am I assuming right ?
Thnak you
I am know at this game. What is the best VM product to use to develop Linux images to export to AWS.
Any help would be appreciated.
We are working to replace VMware 5.5 with VMware 6.7. When researching this move we discovered that our storage - Netapp FAS3250 running ONTAP 8.2.4P4 7mode is not supported by Netapp.
This is a Cisco UCS system using FCoE only.
Has one tired the above? Are there any known problems?
Thanks for any queues,
Gleng
Good evening, All.
We are use VRA 7.3 with ESXi 6.0 Patch 6
We have blueprint with software components that include some script to install SQL server,Antivirus agent and some third party software.
When I request item from VRA GUI , it successful deploy vm with the script running
When I request through REST API , with request template( I am use PowrVra . The machine was deployed, but the script apparently not running
Does anybody running into similar issue?
Thank you in advance,
I am having an issue trying to do a file restore using VDP 6.1. This is a fresh install and haven't been able to successfully restore a file. I log into the file level restore web client from a VM that is being backed up. I can log in and mount the backups but after I choose a file/folder to restore the window with the Restore Destination is blank and can't choose anywhere to restore.
I have tried multiple things based on my research. I have tried two different VMs (both being backed up), Windows 2008 R2 and Windows 2012R2. I have also tried a variety of usernames using basic and advanced login. I have used the same vcenter username in the advanced login, and for the local credential I have used a variety of domain admins, domain users, local admin of host, and various logins from vsphere. I have tried a variety of browsers also, Google Chrome (most recent version), Mozilla Firefox (most recent version), and IE 11 with the url in the trusted sites.
I am not sure if this is a permission issue with the local credential or a flash compatibility issue. Any help will be greatly appreciated, been banging my head on this for multiple days.
Hi vTeam, I hope you're all doing well.
I'm creating a nested VMware LAB where I have 1 physical server (Dell OptiPlex 790) with 16GB of RAM and 2 Physical Processors. I've installed ESXi on this server and inside I've created 2 VMs with ESXi installed on each (one with 11GB RAM for vCenter and the other with 5GB RAM for DC & DNS + Windows 7 and OpenFiler). I can easily create VMs on it but when I tried to deploy VCSA 6.5 if fails when it reaches 80% with this error: "Task failed on server: Module 'CPUID' power on failed.", any ideas, could you please help me? Thanks a lot in advance and hope to hear from you all as soon as possible guys, cheers.
I have a blocking EB Subscription published.
Data/Lifecycle state/Lifecycle state name, Equals, “VMPSMasterWorkflow32.BuildingMachine“.Data/Lifecycle state/Lifecycle state/State phase, Equals, PRE.
Data/Machine/Machine type, Equals, “Virtual Machine“.
It is attached to a workflow with 1 input 'payload' of type Properties and 1 output 'virtualMachineAddOrUpdateProperties' of type Properties. I use payload just to verifty that Iam receiving data.
I have a blueprint with a VM on it. Reservation policy's reservation has 1 network, a customization spec to join domain,clone from template, no Network properties, and 1 Custom property Extensibility.Lifecycle.Properties.VMPSMasterWorkflow32.BuildingMachine with the value of * .
When I select the blueprint, I ge the payload in vRO and I can see properties so I know it is firing. I have read from an article using this method to set a customization spec name that I shoul d just be able to create an output paramater virtualMachineAddOrUpdateProperties and set the network in a scriptable task information as so:
virtualMachineAddOrUpdateProperties = new Properties();
virtualMachineAddOrUpdateProperties.put("VirtualMachine.Network0.AddressType", 'Static');
virtualMachineAddOrUpdateProperties.put("VirtualMachine.Network0.Address", '10.7.128.28');
virtualMachineAddOrUpdateProperties.put("VirtualMachine.Network0.SubnetMask", '255.255.255.0');
virtualMachineAddOrUpdateProperties.put("VirtualMachine.Network0.Gateway", '10.7.128.3');
virtualMachineAddOrUpdateProperties.put("VirtualMachine.Network0.Name", '10.7.128.x');
I have the output parameter set and it DOES NOT update the IP, I just get an APIPA 169.x.x.x address.
Is it supposed to work this way in 7.x? Is the vCAC entity passed automatically to the workflow and I just use virtualMachineAddOrUpdateProperties/
thanks,
ds
I have been able to download and review our Operational Summary and have begun to mitigate the findings such as upgrading guest VM's to virtual hardware 9 or greater however every day the new report does not seem to reflect this and maintains the same count of guest VM's or ESXi hosts that have actually been patched.
I've stopped and restarted the collector, but how do I get it to actually rescan or refresh the findings? Or, is is supposed to be refreshing the findings?
Thank you,
Tina
Hi,
I have used ISO file to install Server 2012,
now I want to upgrade it to 2016, I have inserted the ISO 2016 into the VM, but not able to boot from it:
when I enter on EFI CDROM, nothing happens
However, when I boot from this OS 2012, and I go to CDROM, it is working fine:
any way to fix this ?
Hi everyone,
I've installed a vCenter Virtual Appliance 6.5 in my environment, and I've added two ESXI 6.0 to this vCenter. But, since I've installed the vCenter, some issues happened (take a look the picture attached on this discussion), such as: I can't make vMotion between ESXi, the VM creation isn't working, etc. What can I do to fix that?
Question: Should I deactivate Virtual San?
Obs.: When I've created the Cluster, I've activate some features. These configurations are attached.
Thanks in advance
I've got the latest fast-track version of windows 10 (build 180706) and I'm trying to install powercli from the Powershell Gallery (PowerShell Gallery | VMware.PowerCLI 10.1.1.8827524 ).
When I do this I get errors about conflicting cmdlets:
PS C:\WINDOWS\system32> Install-Module -Name VMware.PowerCLI
Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running
the Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): Y
PackageManagement\Install-Package : The following commands are already available on this
system:'Export-VM,Get-VM,Get-VMHost,Move-VM,New-VM,Remove-VM,Restart-VM,Set-VM,Set-VMHost,Start-VM,Stop-VM,Suspend-VM'. This module
'VMware.VimAutomation.Core' may override the existing commands. If you still want to install this module 'VMware.VimAutomation.Core', use
-AllowClobber parameter.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1809 char:21
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Exception
+ FullyQualifiedErrorId : CommandAlreadyAvailable,Validate-ModuleCommandAlreadyAvailable,Microsoft.PowerShell.PackageManagement.Cmdlet
s.InstallPackage
PS C:\WINDOWS\system32>
I know I can get around this with the -AllowClobber parameter but that's a really kludgy way to do this and will most likely cause problems in a mixed Hyper-V/Vmware environment.
I'm having some issues getting the Identity manager/WorkspaceOne working correctly for outside access.
We're are currently using one UAG in a DMZ that connects to a single horizon sever and is setup with a reverse proxy setup to identity manger. We are not using load balances as this is a small horizon deployment.
Problem is: If I launch the website externally it is showing up in a weird format, (Missing background and mostly text) and when we attempt to login we get "We were unable to authenticate you. Check your credentials and try again. If your credentials are correct and you still cannot log in, your password might be locked. Wait a few minutes and try again." at the top of the web-page that still looks out of wack. It basically loops this way every time I try to login as a domain user.
However, if I login to the "System" domain as admin I am able to login and the Dashboard looks fine. After logging out of the system admin page, the Login page loads correctly and users are able to log in and launch Horizon desktops.
I've attached an image below.
Basically- We can't login as a domain user or get the web page to load correctly unit we login as system admin in system domain and logout again. after this the domain login page will continue to work correctly until we clear the web browser settings, Cookies, etc.
This issue happens in all web browsers, (Chrome,IE, Firefox, Edge)
Has anyone else seen this behavior before?
Jason Hartley
VMware Systems Specialist
Office: 502-272-4917
"Develop the skill of sensing problems when they are still small and taking care of them before they become intractable"—Robert Greene
Author : Brian Neuhauser
Topic Name : Upgrading VMware Products Integrated with vRealize Automation
Publication Name : Installing and Upgrading vRealize Automation
Product/Version : vRealize Automation/7.4
Question :
Why is this order documented as such? Could vRealize Operations and Log Insight not be placed earlier? We have release notes that state that vRB should be updated earlier as well.
Just upgraded to 15.0.0 from 14. I can not clone or upgrade machines (selecting full clone). I get a parameter incorrect error.
This is major.
Is there a good way of stopping certain users from using applications within a certain appstack?
We have an appstack with 2017/2018/2019 versions of the Autodesk Design Suite but some users are not meant to be using certain programs as they dont know how to use them proerply e.g. Revit but they do anyway and it is causing issues within the business.
Instead of me having to create multiple appstacks for each team/user base, is there something i can do to stop certain apps being accessible. I have looked at the UEM application blocker but from what i can see, it disabled EVERYTHING and you then have to create groups of users that are able to access software you entitle them too. Unless im wrong on that?
We are on View 7.5, UEM 9.4, App volumes 9.14
So I am having a problem with app volumes. I have tried many different things, and have narrowed down the problem to logging in with a domain account vs a local account.
Currently I have a provisioning machine that is Win10 that has been optimized with the Optimization tool with the Win10 template and the AppVol template. AppStacks create fine, and attach to VMs without an issue.
The issue comes when I go to login to the Win10 VM that attaches to the AppStack. This Win10 VM also has been optimized with the tool. I have tried with an without optimization as well.
If I attach the AppStack to the VM, once I enter my login credentials, I get to the preparing windows stage, then get an sihost.exe error. If i detach the AppStacks and reboot, I can log in fine. Also I can login with a local account and the apps in the AppStack get attached and work perfectly. Both the domain and local accounts are Admin accounts.
The only thing I can think of is, we are using a secured Win10 Image, we are required to use this DoD Template. So it may be a group policy setting, I just don't know which it may be.
Thank you in advance for any possible answers.
Hi there
I've recently upgraded to a 2018 MBP and I'm finding Fusion (both 10 and 11) use excessive CPU. I'm coming from a 2012 27 inch iMac.
On the new machine vmware-vmx uses 30+% CPU while the guest is idle. Fans spin up. The old machine sits at around 5-7%.
Something's not quite right here.
What to do? :-/
hi can someone provide the best plan of attack to upgrade
I have an ibm server 3650 that is running exsi 4.1 local storage.
I like to upgarde it to 5.5.
can I do an inplace upgrade of this host. what would be the recommended steps in getting this done.
thanks for any info / recommendation you can provide.
thanks
dave