Error : Host Profile compliance fails on unique SNMPv3 Engine ID and UserVars.HostClientCEIPOptIn.

Products

• VMware vSphere ESXi

Issue/Introduction

vSphere ESXi hosts report a "Not Compliant" status when evaluated against a global Host Profile cluster blueprint. The compliance report identifies the following specific configuration mismatches against the baseline:

• SNMP engineid and users: The host profile expects a static hardcoded Engine ID but the target host possesses a unique hardware-generated identity.

• Service ntpd: The NTP service startup policy has drifted to manual, failing the automatic baseline requirement.

• Advanced Option UserVars.HostClientCEIPOptIn: The value has drifted to 2, failing the baseline requirement of 0 (disabled).
  

Environment

 

• VMware vCenter Server 

• VMware vSphere ESXi 

 

Cause

The Host Profile is improperly enforcing a single, static SNMP Engine ID copied from a reference host, which architecturally conflicts with the unique, MAC-based Engine IDs dynamically generated by and required for each individual ESXi host's SNMPv3 cryptographic security. The NTP and CEIP mismatches are the result of standard administrative configuration drift over time.

Resolution

To resolve  the global SNMP configurations and restore cluster-wide compliance, perform the following steps:

1. Prior to performing cluster-wide remediations, ensure data safety safeguards are met. See: Best practices for using snapshots in the vSphere environment.

2. Navigate to Policies and Profiles > Host Profiles in the vCenter Server UI and choose to edit the affected cluster profile.

3. Expand General System Settings > Management Agent Configuration > SNMP Agent Configuration.

4. Modify the policy selection dropdown for both Engine ID and SNMPv3 User Security Model to: "User must explicitly choose the policy option".

5. Save the profile changes.

6. Return to the target host's configuration panel, select Edit Host Customizations, and manually update the specific fields with the host's distinct hardware Engine ID and matching cryptographic user hashes.

7. To remediate the ntpd and CEIP advanced option drifts, right-click the affected host within the vSphere inventory and locate the Host Profiles submenu.

8. Click the Remediate button. vCenter Server will automatically align the NTP service startup configuration and change the UserVars.HostClientCEIPOptIn advanced registry value back to 0 simultaneously.

Additional Information

Forcing a static Engine ID globally via the command line (esxcli system snmp set --engineid) is highly discouraged. SNMPv3 standard requirements demand unique system identifiers per agent to prevent notification drops and polling conflicts within third-party monitoring software ecosystems.

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-monitoring-and-performance/snmp-and-vsphere/configure-snmp-for-esx-esxi/configure-esxi-for-snmp-v3/configure-the-snmp-engine-id.html