How to reset the root password in VMware Aria Operations for Logs (formerly VMware vRealize Log Insight)
search cancel

How to reset the root password in VMware Aria Operations for Logs (formerly VMware vRealize Log Insight)

book

Article ID: 319358

calendar_today

Updated On:

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

The VMware Aria Operations for Logs virtual appliance root password can be different than the admin account password that you set when configuring the application.

Symptoms:
  • The VMware Aria Operations for Logs (formerly VMware vRealize Log Insight) virtual appliance root password is unknown.
  • Resetting the root password via vApp Options fails in 4.x.


Environment

VMware vRealize Log Insight 8.x
VMware vRealize Log Insight 4.x
VMware Aria Operations for Logs 8.x
VMware Cloud Foundation 5.x

Resolution

Use the steps below that are appropriate for the version of VMware Aria Operations for Logs (formerly VMware vRealize Log Insight) that is in use in the environment.

 

Quick Links

 

VMware Aria Operations for Logs 8.14 and newer

  1. In the vSphere Client, open the console of the desired node.
  2. With the console open, restart or power on the virtual machine.
  3. When the GRUB loader menu appears with the Photon splash screen, immediately press the letter e to launch the GNU GRUB edit menu. Navigate to the end of the line that starts with linux.
Notes:
  • If VMware Aria Operations for Logs was upgraded from a previous release and displays the SUSE Linux splash screen, use the up and down arrow keys to select the Photon OS Latest option. The cursor appears at the end of a line of boot options near the bottom of the display. Even if the Photon OS Latest option appears to already be selected, use the arrow keys. Otherwise, the machine continues to boot and the appliance must be rebooted to start the process over.
  • If you cannot reach the boot menu before it disappears, enable Force BIOS setup in the Virtual Machine's Settings > VM Options > Boot Options and reboot.
  1. At the end of the line, add a space, then type rw init=/bin/bash which adds another option to the line.
  2. Press F10 or CTRL+X to boot the appliance.
Notes:
  • If VMware Aria Operations for Logs was upgraded from a previous release and displays the SUSE Linux splash screen, Press Enter to boot the appliance.
  • The virtual appliance starts in single-user mode.
  1. Type mount -o remount,rw / to mount the partition in read/write mode.
  2. Type passwd root, and follow the prompts to create a new root password.
  3. Validate the root account is not locked and unlock if needed.
  • Type /usr/sbin/faillock --user root to determine if the root account is locked.
  • If the value of Failures is 3 or more, type/usr/sbin/faillock --user root --reset to reset the Failures count and unlock the root account.
  1. Type sync and press Enter to flush the data to disk.
  2. Type umount / and press Enter.
  3. Type reboot -f and press Enter.

 

VMware vRealize Log Insight 8.0 through 8.12

  1. In the vSphere Client, open the console of the desired node.
  2. With the console open, restart or power on the virtual machine.
  3. When the GRUB loader menu appears with the Photon splash screen, immediately press the letter e to launch the GNU GRUB edit menu. Navigate to the end of the line that starts with linux.
Notes:
  • If VMware Aria Operations for Logs was upgraded from a previous release and displays the SUSE Linux splash screen, use the up and down arrow keys to select the Photon OS Latest option. The cursor appears at the end of a line of boot options near the bottom of the display. Even if the Photon OS Latest option appears to already be selected, use the arrow keys. Otherwise, the machine continues to boot, and you have to start over.
  • If you cannot reach the boot menu before it disappears, enable Force BIOS setup in the Virtual Machine's Settings > VM Options > Boot Options and reboot.
  1. At the end of the line, add a space, then type rw init=/bin/bash which adds another option to the line.
  2. Press F10 or CTRL+X to boot the appliance.
Notes:
  • If VMware Aria Operations for Logs was upgraded from a previous release and displays the SUSE Linux splash screen, Press Enter to boot the appliance.
  • The virtual appliance starts in single-user mode.
  1. Type mount -o remount,rw / to mount the partition in read/write mode.
  2. Type passwd root, and follow the prompts to create a new root password.
  3. Validate the root account is not locked and unlock if needed.
  • Type pam_tally2 -u root to determine if the root account is locked.
  • If the value of Failures is 3 or more, type pam_tally2 -u root --reset to reset the Failures count and unlock the root account.
  1. Type sync and press Enter to flush the data to disk.
  2. Type umount / and press Enter.
  3. Type reboot -f and press Enter.

 

VMware vRealize Log Insight 4.x

  1. In the vSphere Client, open the console of the desired node.
  2. With the console open, restart or power on the virtual machine.
  3. When the GRUB loader menu appears, immediately use the up and down arrow keys to navigate to the SUSE Linux Enterprise Server {version} option.
Notes:
  • Press the up and down arrow keys even if the option appears to already be selected. Otherwise, the machine continues to boot and the appliance must be rebooted to start the process over.
  • The cursor appears at the end of a line of boot options near the bottom of the display.
  • If you cannot reach the boot menu before it disappears, enable Force BIOS setup in the Virtual Machine's Settings > VM Options > Boot Options and reboot.
  1. At the end of the line, type rw init=/bin/bash which adds another option to the line.
  2. Press Enter.
Note: The virtual appliance starts in single-user mode.
  1. Type mount -o remount,rw / to mount the partition in read/write mode.
  2. Type passwd root and follow the prompts to create a new root password.
Note: If the above command fails, try running sudo passwd root instead.
  1. Validate the root account is not locked and unlock if needed.
    • Type pam_tally2 -u root to determine if the root account is locked.
    • If the value of Failures is 3 or more, type pam_tally2 -u root --reset to reset the Failures count and unlock the root account.
  2. Type sync and press Enter to flush the data to disk.
  3. Type umount / and press Enter.
  4. Type reboot -f and press Enter.


Additional Information

Root Password Expiration Settings:

Verify Root Password Expiration Setting:

Log in to the Aria Operations for Logs server using SSH or the vSphere Client.

Run the following command to check the root account expiration setting:

chage -l root

Modify Root Password Expiration:

If necessary, configure a password expiration policy:

chage -M <days> root

Replace <days> with the desired number of days before expiration.

To set the password to never expire, replace days with: 99999

VMware Cloud Foundation Installations

If the nodes are connected with SDDC Manager on VMware Cloud Foundation and the root password has been reset outside of SDDC Manager:

Aria Operations for Logs nodes are disconnected in SDDC manager.
Password rotation, upgrade, or remediation could not previously be performed from the SDDC.
Password is now known and SSH access is possible.
Root account is not locked (because this KB was followed to reset the password).
Please use the guide to Remediate the password in SDDC Manager: Remediate Passwords
Powered by Wolken Software