How to Check Login History to an ESXi Host

Products

• VMware vSphere ESXi

Issue/Introduction

This article describes how to check login history to an ESXi host from the logs on the ESXi host.

Environment

ESXi 8.0, ESXi 9.0

Resolution

Login history to an ESXi host is recorded in "/var/run/log/hostd.log" with messages similar to the following:

* Login successful:
YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[526161]: [Originator@X sub=Vimsvc.ha-eventmgr opID=X] Event 56901 : User [email protected] logged in as ...

* Login failure:
YYY-MM-DDTHH:MM:SSZ Wa(164) Hostd[526170]: [Originator@X sub=Vimsvc.HaSessionManager opID=X] Rejected password for user root from X.X.X.X - session=X
YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[526170]: [Originator@X sub=Vimsvc.ha-eventmgr opID=X sid=X] Event X : Cannot login [email protected]

* Logout:
YYYY-MM-DDTHH:MM:SSZ In(166) Hostd[526154]: [Originator@X sub=Vimsvc.ha-eventmgr opID=X sid=X user=root] Event X : User [email protected] logged out (login time: ...)

Additional Information

Japanese KB: ESXi ホストへのログイン履歴を確認する方法