CIM Subscriptions

[Shocko]

Hi, guys. I have been creating some host profiles to enforce compliance across my ESXi 5 u1 estate. When I check for compliance against one of the machines, the following shows up in relation to CIM indications:

Found extra CIM-XML Indication Subscription on local system for query select * from HP_DeviceIndication sent to destination https://10.112.64.210:50004/myesserver?wbemip=<!IPV4>

Found extra CIM-XML Indication Subscription on local system for query select * from CIM_AlertIndication sent to destination https://10.112.64.210:50004/myesserver?wbemip=<!IPV4>

Found extra CIM-XML Indication Subscription on local system for query SELECT * FROM CIM_AlertIndication sent to destination https://10.112.64.210:50004/myesserver?wbemip=<!IPV4>

Found extra CIM-XML Indication Subscription on local system for query select * from CIM_AlertIndication sent to destination https://10.112.64.210:7905/wbem

Found extra CIM-XML Indication Subscription on local system for query select * from HP_AlertIndication sent to destination https://10.112.64.210:3509

Now, i understand that most of these indications were created by my HP SIM server (so it can subscribe to hardware alerts etc.) . The software has been upgraded many times and changed ports etc. hence the multiple indications. Now, thing is, how to I clean-up and remove these stale indications form the ESX server ? Any command line to manipulate CIM indications ?

[MKguy]

You should disable the profile configuration checks for CIM Indication Subscriptions completely, because the exact strings will usually always be different for each host (the config string contains the ESXi hostname). Even cleaning up older entries might not help you out here:

http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.hostprofiles.doc_50%2FGUID-0...

Files related to CIM subscriptions can be found in /var/lib/sfcb/registration/repository/root/interop/, but be cautious if you want to edit files there.

[Shocko]

HI, i need to clear them for compliance. As these as CIM indications, they are sent from the ESXi hosts. Compliance states that these should only be sent to required destinations. Some of the destinations in the list were for old servers and those destination IP addresses are now in use on other servers. This breaks PCI as basically, although the info sent in the indication is essentially harmless, those machines still should receive it. I'll see if editing the file on a test host resolves

[Shocko]

I guess I might be able to do this with perl scripts. I'll start reading the SDK

[ScreamingSilenc]

This compliance error appears on HP Hardware when HP Systems Insight Manager (HP SIM) is in use, you can override the error by disabling "CIM Indication Subscriptions" as mentioned below

1. Open vSphere Client

2. Navigate to Management > Host Profileshost-profiles

3. Right Click the Profil and select Enable/Disable Profile Configuration

4. Disable CIM Indication Subscriptions

5. Check the profile compliance again, and the message should disappear.

Or as MKguy has mentioned you can delete the CIM subscriptions found in /var/lib/sfcb/registration/repository/root/interop/ check the KB VMware KB: Applying a host profile fails with the error: The requested object could not be found

[Shocko]

Thanks Mustafa but disabling the compliance check against the host profile does not actually help me for PCI compliance, it simply masks the underlying issue. I need to remove the alert subscriptions to prevent data being sent to unwanted destinations.

[Shocko]

Seems like you can just remove them:

VMware KB: Applying a host profile fails with the error: The requested object could not be found

[ScreamingSilenc]

Try removing the undesired subscriptions and run the compliance check, I hope it fix the issue.

[bobinhedgeorge]

The way that I've found to remove the CIM Indication Subscriptions without having to log in to each host:

1. Edit host profile

2. Expand CIM Indication Subscriptions

3. Delete each item for CIM-XML Indication Subscriptions

4. Place hosts in maint mode and apply the profile.