SSH service starts automatically after management IP change - VMware vSphere ESXi

Products

• VMware vSphere ESXi

Issue/Introduction

After changing the management interface on ESXi hosts that have SSH configured to "Start Manually" the SSH service is starting automatically. If stopped the service will restart after a period of time. 

Environment

vSphere

Cause

A third-party integration is enabling SSH.

Resolution

To troubleshoot this and find the source, perform the following steps:

1. From the ESXi hostd.log identify where SSH was enabled and capture the first part of the opID value. 6ab2371d

2026-05-19T18:33:24.074Z In(166) Hostd[2099408]: [Originator@6876 sub=Vimsvc.ha-eventmgr] Event 75888 : SSH access has been enabled.
2026-05-19T18:33:24.204Z In(166) Hostd[2099388]: [Originator@6876 sub=Hostsvc.ServiceSystem opID=6ab2371d-e2-3c38 sid=52ac894e user=vpxuser:EXAMPLE.COM\USER1] TSM-SSH running status is true

 

2. From the vCenter server search the vpxd.log file for that opID. Pull the session ID from the output: 52b7c34c-cd4c-3c03-8d84-45131aa8e670

vpxd-2334.log:2026-05-19T18:33:24.027Z info vpxd[05991] [Originator@6876 sub=vpxLro opID=6ab2371d] [VpxLRO] -- BEGIN task-5586416 -- serviceSystem-453666 -- vim.host.ServiceSystem.start -- 52b7c34c-cd4c-3c03-8d84-45131aa8e670(52c338dd-aef9-8f65-e9a2-88f3a240fc65)
vpxd-2334.log.gz:2026-05-19T18:33:24.231Z info vpxd[05991] [Originator@6876 sub=vpxLro opID=6ab2371d] [VpxLRO] -- FINISH task-5586416

 

3. From the vCenter server search the vpxd-profiler.log for the session ID 52b7c34c-cd4c-3c03-8d84-45131aa8e670

-> /SessionStats/SessionPool/Session/Id='52b7c34c-cd4c-3c03-8d84-45131aa8e670'/Username='EXAMPLE.COM\User1'/ClientIP='###.###.###.###'/HttpSessionObject/Hidden/total 0
--> /SessionStats/SessionPool/Session/Id='52b7c34c-cd4c-3c03-8d84-45131aa8e670'/Username='EXAMPLE.COM\User1'/ClientIP='###.###.###.###'/PropertyCollector/UnfinishedRetrieversCnt/total 0

 

4. Identify the software on the 'ClientIP' from the vpxd-profiler.log that is communicating through vCenter to enable SSH. Engage the software vendor for remediation. 

Additional Information

In this particular example the product in question was Zerto. 

Collecting diagnostic information for VMware vCenter Server