SFTP VAMI Backups Failed on vCenter When Targeting Windows SFTP Server

Products

• VMware vCenter Server

Issue/Introduction

• SFTP VAMI backups fail on VMware vCenter Server Appliance (vCSA) when targeting a Windows-based SFTP server.
  
  
• Log analysis of /var/log/vmware/applmgmt/appliance-health.log confirms connection refusal to the local applmgmt health API endpoint:
YYYY-MM-DDThh:mm:ss.245 [521064]ERROR:applmgmt-health:ConnectionError(MaxRetryError("HTTPConnectionPool(host='<REDACTED_HOSTNAME>', port=8201): Max retries exceeded with url: /rest/appliance/health/applmgmt (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7faf87c27610>: Failed to establish a new connection: [Errno 111] Connection refused'))"))

• Log analysis of /var/log/vmware/applmgmt/backup.log indicates that Unix-specific shell execution against the target Windows SFTP server fails, causing script failure:
  YYYY-MM-DDThh:mm:ss.173 [20260805-094721-25148086] [ConfigFilesBackup:PID-1393026] [Proc::GetProcsStatus:Proc.py:385] ERROR: rc: 1, stderr: b"'cat' is not recognized as an internal or external command,\r\nope
rable program or batch file.\r\n"
...
YYYY-MM-DDThh:mm:ss.183 [20260805-094721-25148086] [VCDBBackup:PID-1393028] [VCDB::BackupVCDB:VCDB.py:2053] ERROR: Failed to backup VCDB.
util.Common.BackupRestoreError: Failed to backing up Postgres config files.
Underlying process status. rc: 1

Environment

• VMware vCenter Server Appliance (vCSA) 9.0.2.0
• VMware Cloud Foundation (VCF) 9.0.2.0

Cause

The applmgmt service attempts to establish a passwordless SSH connection using ssh-copy-id prior to performing the SFTP VAMI backup. On Windows-based SFTP servers, this operation fails because there is no native Unix shell (such as cat) available to append SSH public keys to an authorized_keys file. The resulting timeout (exceeding 60 seconds) causes the applmgmt service to stop responding to local health checks, prompting vmon to restart applmgmt and prematurely terminate the active backup job.

Resolution

Configure the vCenter Server Appliance to bypass the SSH tunnel creation and proceed directly to the file transfer using curl. Follow the below steps:

1. Log in to the vCenter Server Appliance via SSH as the root user.
   
   
2. Create a backup of the existing appliance configuration file:
   cp /etc/applmgmt/appliance/appliance.conf /etc/applmgmt/appliance/appliance.conf.bak


3. Use jq to add the skipSshTunnel parameter and set it to true:
   echo "$(jq '.backupRestore.skipSshTunnel=true' /etc/applmgmt/appliance/appliance.conf )" > /etc/applmgmt/appliance/appliance.conf


4. Restart the appliance management service for the changes to take effect:
   service-control --restart applmgmt