Event: "User [email protected] logged out (login time: [Date/Time], number of API invocations: 7, user agent: pyvmomi 8.0.2.0.1 internal Python/3.11.12)"

Products

• VMware vSphere ESXi
• VMware Cloud Foundation

Issue/Introduction

• After upgrading to ESXi 8.0U3i, the vSphere Client event viewer, the hostd.log, and journalctl files display the following login and logout events for the user [email protected] approximately every five minutes:

User [email protected] logged in as pyvmomi 8.0.2.0.1 internal Python/3.11.12 (VMkernel; 8.0.3; x86_64)

User [email protected] logged out (login time: [Date/Time], number of API invocations: 7, user agent: pyvmomi 8.0.2.0.1 internal Python/3.11.12)

• The sut.log file displays the following:

YYYY-MM-DDT##:##:##.###Z In(30) sut[2101234]: [INFO] :: [global.cpp:1431] :: Console log content for the command (esxcli system maintenanceMode get >& /tmp/stagingdirectory/sutm

YYYY-MM-DDT##:##:##.###Z In(30) sut[2101234]: [INFO] :: [hptoolsapplication.cpp:2028] :: Console log content for the command (esxcli network firewall get >& /opt/sut/tmp/sutfirewallstatus.l

Environment

• ESXi: 8.0U3i
• VCF: 5.2.3
• HPE ProLiant Gen10
• HPE Smart Update Tools (SUT)

Cause

• The issue is caused by the HPE Smart Update Tools (SUT) service polling the host every five minutes to check for firmware updates or system status.

esxcli system maintenanceMode get

esxcli network firewall get

• These esxicli commands trigger a full session login/logout via hostd, which will be recorded as an event.

Resolution

• Contact HPE Support to request a change in the polling interval or to ask if their product can be updated to use localcli for these "get" commands.

• Using localcli avoids the hostd login requirement and prevents event flooding.

Additional Information

Confirm SUT is causing the events

1. Confirm SUT is installed on the host:

   esxcli software vib list | grep -E -i 'sut'

2. Confirm these events are caused by SUT and not other esxcli commands by stopping the SUT service:

   /etc/init.d/sut stop

3. Monitor the logs and/or the vSphere client event viewer for 10 minutes to ensure the events stop.