PowerCLI Get-Log fails on encrypted ESXi hosts with "host is in crypto safe mode and the vm-support incident key is missing"

Products

• VMware vCenter Server

Issue/Introduction

When attempting to collect diagnostic log bundles via PowerCLI (using the Get-Log cmdlet) from ESXi hosts configured with Host Encryption Mode, the command fails silently or times out. Reviewing the hostd.log on the affected host reveals that the task is intentionally blocked with the error:

"Command cannot succeed because this host is in crypto safe mode and the vm-support incident key is missing."

This issue occurs because current versions of PowerCLI (9.1 and earlier) rely on a deprecated vSphere API method (generateLogBundles) that does not support automated log bundle generation for encrypted hosts.

Environment

VMware vCenter Server 8.x

VCF PowerCLI 9.x & later

Cause

This is a known issue. Previous versions of PowerCLI rely on a deprecated API method (vim.DiagnosticManager.generateLogBundles). By design, this older API method does not support diagnostic bundle generation for ESXi hosts operating in "crypto safe mode" to prevent the accidental leakage of cryptographic keys.

Resolution

Engineering has identified the issue and is working to address it in a future release of VCF PowerCLI.

In this release, PowerCLI is migrated to use the newly recommended API (vm-support.cgi framework), which fully supports remote log collection for encrypted ESXi hosts without triggering the crypto safe mode lock.

Additional Information

Workaround

Until this issue is resolved in a future release of VCF PowerCLI, you can use one of the following workarounds to collect logs from encrypted hosts:

Workaround 1: Use the vSphere Client UI (Recommended)

The vSphere Client UI utilizes the correct API to handle crypto safe mode.

1. Log into the vSphere Client.

2. Right-click the affected encrypted ESXi host.

3. Select Export System Logs and proceed with the standard log collection wizard.

Workaround 2: Use an Alternative PowerShell Script

If automated collection via PowerShell is required, you can use the following script. This script bypasses the deprecated API and directly calls the recommended vm-support.cgi endpoint using your active PowerCLI session token.

$credentials = Get-Credential
$hostAddress = 'Your ESXi host name'
$conn = Connect-VIServer -Server $hostAddress -Credential $credentials
$supportEndpoint = "https://$hostAddress/cgi-bin/vm-support.cgi"

$groups = @(
    # Add comma-separated groups as a filter if any.
    # Leaving the array empty will generate a full bundle, e.g. 'Hardware'
)

if ($groups -and $groups.length -gt 0) {
    $supportEndpoint += "?groups=" + [string]::Join(',', $groups)
}

[System.Uri]$Uri = $supportEndpoint
$Cookie = New-Object System.Net.Cookie
$Cookie.Name = "vmware_soap_session"
$Cookie.Value = $conn.SessionId
$Cookie.Domain = $uri.DnsSafeHost

$WebSession = New-Object Microsoft.PowerShell.Commands.WebRequestSession
$WebSession.Cookies.Add($Cookie)

# Splat the parameters
$props = @{
    Uri = $uri.AbsoluteUri
    Method = 'GET'
    WebSession = $WebSession
    #CertificateThumbprint = 'certificate-thumbprint'
    SkipCertificateCheck = $true
    OutFile = "$hostAddress-support-bundle-$(Get-Date -Format "yyyy-MM-dd-HH-mm").tar.gz"
}

Invoke-RestMethod @props
$conn | Disconnect-VIServer -Confirm:$false