Avatar of Andrej Pirman
Andrej Pirman
Flag for Slovenia asked on

ESXi 5.0 repeating event user root logged in/out

Hi,

I have been dealing with ESXi hosts having problems with constantly repeating root logged in / logged out event. Every 10 seconds these events repeat:
User root@1.2.3.4 logged in  23.12.2012 23:29:59   
User root logged out 23.12.2012 23:30:16

Open in new window

1.2.3.4 is my monitoring server's public IP address.

I always managed to drain it down to some monitoring software, which was guilty for these logs, but this time I cannot find the real suspect.

I have VEEAM monitoring installed, so I killed ALL Veeam services.
After that, I only see repeating every 10 seconds:
User root logged out 23.12.2012 23:31:26

Open in new window


Ok, there must be something else.
I monitor TCP connections and I only see my Vsphere CLIENT connected to remote port 443, nothing else. If I close vSphere Client, all those 443 port TCP connections go away.

But I was using it fine for years now...and all of the sudden...here we have this annoying event again.
I am frustrated because this repeating event pushes out the IMPORTANT waringn about storage deterioration problem, which I hunt for - but if I have just those "root logged out" events all over, I cannot watch for realy importan event.

Any idea?
VMware

Avatar of undefined
Last Comment
Andrej Pirman

8/22/2022 - Mon
Andrej Pirman

ASKER
ADDED:
After I restart host Management Agents, this issue stops...
...BUT I loose hardware status in vSphere client.

Seems like some vendor-specific MIB/CIM is not up to date.
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)

I would change the root password, and see which of your applications, monitoring apps fails!
ASKER CERTIFIED SOLUTION
Andrej Pirman

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Andrej Pirman

ASKER
Hanccocka gave me an advice, but from my initial question it was clear, that I was already past suggested solution, therefore despite of good intention, I decided not to reward his suggestion.<br />Thanx anyway!
Your help has saved me hundreds of hours of internet surfing.
fblack61