ESXi 5.0 and higher maintains a history of all commands entered in the ESXi Shell, whether accessed at the console or via SSH. This shell command history is maintained in the shell.log
file. Within the transcription of commands, the command issuer is identified by the process or world ID. This article describes how to correlate authentication information from the auth.log
file with the history of commands executed in the ESXi Shell.
For more information on the locations of the log files described, see Location of ESXi 5.0 log files (306907) and Location of log files for VMware products (306962).
To determine the commands executed in the ESXi Shell, and which user and client issued the request:
auth.log
and shell.log
log files.
appname=login,sshd,shell
less
command.https://ESXiHostnameOrIP/host/auth.log
and https://ESXiHostnameOrIP/host/shell.log
.vifs
command line utility in the vCLI to copy the logs to a client and review the logs.vm-support
log bundle./var/log/auth.log
in a text viewer.YYYY-MM-DD HH:MM:SS login[64386]: root login on 'char/tty/1'
YYYY-MM-DD HH:MM:SS sshd[12345]: Connection from 10.11.12.13 port 2605
YYYY-MM-DD HH:MM:SS sshd[12345]: Accepted keyboard-interactive/pam for root from 10.11.12.13 port 2605 ssh2
YYYY-MM-DD HH:MM:SS sshd[64386]: Session opened for 'root' on /dev/char/pty/t0
YYYY-MM-DD HH:MM:SS sshd[12345]: Session closed for 'root' on /dev/char/pty/t0
...
YYYY-MM-DD HH:MM:SS sshd[12345]: Session closed for 'root' 2
YYYY-MM-DD HH:MM:SS sshd[12345]: Connection from 10.11.12.13 port 2605
YYYY-MM-DD HH:MM:SS sshd[12345]: Accepted publickey for root from 10.11.12.13 port 2605 ssh2
YYYY-MM-DD HH:MM:SS sshd[64386]: Session opened for 'root' on /dev/char/pty/t0
YYYY-MM-DD HH:MM:SS sshd[12345]: Session closed for 'root' on /dev/char/pty/t0
...
YYYY-MM-DD HH:MM:SS sshd[12345]: Session closed for 'root' 2
root
on August 29th at 18:01 GMT. The SSH methods also include the IP address that the connection was initiated from. The shell session is being handled by World 64386
./var/log/auth.log
file./var/log/shell.log
file in a text viewer.YYYY-MM-DD HH:MM:SS shell[64386]: Interactive shell session started
YYYY-MM-DD HH:MM:SS shell[64386]: cd /var/log
YYYY-MM-DD HH:MM:SS shell[64386]: ls
YYYY-MM-DD HH:MM:SS shell[64386]: vmware -v
YYYY-MM-DD HH:MM:SS shell[64386]: exit
64386
, they correspond to the authentication session established by the user root
as described in Step 3.For more information, see the VMware vSphere 5.5 Documentation Center.
Location of log files for VMware products
Location of ESXi 5.0 log files