How to Check Login History to an ESXi Host

Products

• VMware vSphere ESXi

Issue/Introduction

This article describes how to check login history to an ESXi host from the logs on the ESXi host.

Environment

ESXi 8.0, ESXi 9.0

Resolution

Login history to an ESXi host is recorded in "/var/run/log/hostd.log" with messages similar to the following:

* Login successful:
YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[526161]: [Originator@X sub=Vimsvc.ha-eventmgr opID=X] Event 56901 : User root@X.X.X.X logged in as ...

* Login failure:
YYY-MM-DDTHH:MM:SSZ Wa(164) Hostd[526170]: [Originator@X sub=Vimsvc.HaSessionManager opID=X] Rejected password for user root from X.X.X.X - session=X
YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[526170]: [Originator@X sub=Vimsvc.ha-eventmgr opID=X sid=X] Event X : Cannot login root@X.X.X.X

* Logout:
YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[526154]: [Originator@X sub=Vimsvc.ha-eventmgr opID=X sid=X user=root] Event X : User root@X.X.X.X logged out (login time: ...)

Additional Information

Japanese KB: ESXi ホストへのログイン履歴を確認する方法