I have been dealing with ESXi hosts having problems with constantly repeating root logged in / logged out event. Every 10 seconds these events repeat:
User firstname.lastname@example.org logged in 23.12.2012 23:29:59
User root logged out 23.12.2012 23:30:16
184.108.40.206 is my monitoring server's public IP address.
I always managed to drain it down to some monitoring software, which was guilty for these logs, but this time I cannot find the real suspect.
I have VEEAM monitoring installed, so I killed ALL Veeam services.
After that, I only see repeating every 10 seconds:
User root logged out 23.12.2012 23:31:26
Ok, there must be something else.
I monitor TCP connections and I only see my Vsphere CLIENT connected to remote port 443, nothing else. If I close vSphere Client, all those 443 port TCP connections go away.
But I was using it fine for years now...and all of the sudden...here we have this annoying event again.
I am frustrated because this repeating event pushes out the IMPORTANT waringn about storage deterioration problem, which I hunt for - but if I have just those "root logged out" events all over, I cannot watch for realy importan event.