Get Commands executed in ESXi using ssh from Powercli

[Sivaramsharmar]

Hi All,

Is there any way to fetch Commands executed using SSH in ESXi can be fetched from Powercli.

Thanks in Advance

[kunaludapi]

below link is the example, you can use plink.exe tool.

http://kunaludapi.blogspot.in/2013/12/update-ssh-bannermotd-file-on-all-esxi.html

[Sivaramsharmar]

Hi Kunaludapi,

Thanks for your support,

My Requirement is if any one has connected to ESXi via SSH and executed commands like history or checking Logs or any ESXi Command then I need to get the same information via Powercli by doing a query to particular host.

Simply it can be history of commands executed via SSH.

Thanks in Advance.

[kunaludapi]

Yes, you can use plink tool and output to powercli.

[Sivaramsharmar]

Thanks Kunaludapi,

In  your blog you are changing the banner for SSH login so you are editing /etc/motd, but in my case I need to get history of commands who has executed previously and I need to fetch it from Powercli, can you please give me script for the same.

[LucD]

I assume you are looking for something as described in KB2004810, and how to do that from PowerCLI.

Is that correct ?

[Sivaramsharmar]

Hi Lucd,

I am looking for same to get from Powercli as I need this report on a daily basis. Please suggest.

[kunaludapi]

Once you login to the vcenter it will fetch logs from all the esxi host and store under c:\scripts\

On the same location you will have to create a txt file and save below command., file date also can be scripted to change date daily.

cat /var/log/shell.log | grep -i "2015-01-07"

#####################################  

  ## http://kunaludapi.blogspot.com  

  ## Version: 1  

  ## Tested this script on  

  ## 1) Powershell v3  

  ## 2) Powercli v5.5  

  ## 3) Vsphere 5.x  

  #################################### 

Connect-Viserver

Add-PSSnapin vmware.vimautomation.core 

$command = "C:\scripts\motd.txt" 

$esxiHosts = Get-VMHost  

$root = "root" 

$Passwd = "Newused123" 

foreach ($esxiHost in $esxiHosts) { 

   $SSHservice = $esxiHost | Get-VMHostService | where {$psitem.key -eq "tsm-ssh"} 

   if ($SSHservice.Running -eq $False) { 

     $esxiHost | Get-VMHostService | where {$psitem.key -eq "tsm-ssh"} | Start-VMHostService | Out-Null  

   } 

   $result = Write-Output "yes" | plink.exe -ssh root@$esxihost -P 22 -pw $passwd -m $command 

   $esxiHost | Get-VMHostService | where {$psitem.key -eq "tsm-ssh"} | Stop-VMHostService -Confirm:$false | Out-Null

   $filename =  "{0}-{1}{2}{3}-Shell.log" -f $esxihost, $((get-date).day), $((get-date).month), ((get-date).year)

   $result | Out-File c:\scripts\$filename

}

#################################################################################################

I also have another script written,

vGeek: Download logs from all esxi host to desktop to review it later

It will download complete /var/log folder. if you only want shell.log, find the line $filesource = "/var/log/*" and change with below in the script.

$filesource = "/var/log/shell.log"

[LucD]

You can get both of these logs via the Web interface (as described in the KB), if that kind of access hasn't been prohibited in your installation of course.

Something like this should do the trick.

Function Get-LogviaWeb

{

    param(

        [String]$EsxName,

        [String]$LogName,

        [String]$User,

        [String]$Password

    )

    process{

        [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

        $uri = "https://${EsxName}/host/${LogName}"

        [net.httpWebRequest] $request = [net.webRequest]::create($uri)

        $request.Credentials = New-Object System.Net.NetworkCredential($User, $Password, $null)

        [net.httpWebResponse] $response = $request.getResponse()

        $responseStream = $response.getResponseStream()

        $sr = new-object IO.StreamReader($responseStream)

        $sr.ReadToEnd()

    }

}

$esx = 'MyEsx'

$user = 'root'

$pswd = 'MyPassword'

$dest1 = 'C:\Temp\auth.log'

$dest2 = 'C:\Temp\shell.log'

Get-LogviaWeb -EsxName $esx -LogName 'auth.log' -User $user -Password $pswd | Set-Content -Path $dest1

Get-LogviaWeb -EsxName $esx -LogName 'shell.log' -User $user -Password $pswd | Set-Content -Path $dest2

[Sivaramsharmar]

Hi Kunaludapi,

Thanks for your support.Script is working fine. Is there any way that we can get the same result without using plink.

[Sivaramsharmar]

Hi Lucd,

Thanks for your support, as https is blocked for our environment to access ESXi, Is there any other way to get this achieved without using plink. Please suggest.

[LucD · Accepted solution]

There is another way, you download a diagnostics bundle from the ESXi node, and then you extract the 2 log files.

This script requires that you have 7zip installed on the system where you run the script.

In the $dir variable you specify where both logs shall be extracted to.

$esx = 'MyEsx'

$user = 'root'

$pswd = 'MyPassword'

$dir = 'C:\Temp\unzip'

$7zip = """$env:ProgramFiles\7-Zip\7z.exe"""

$path = "$env:Temp"

Connect-VIServer -Server $esx -User $user -Password $pswd

$file = Get-Log -Bundle -DestinationPath $path | Select -ExpandProperty Data

$outfile = "-o$path"

cmd /c "$7zip e $file $outfile esx*.tgz -r"

$tfile = Get-ChildItem -Path $path -Filter "esx*.tgz" |

    Sort-Object -Property LastWriteTime -Descending |

    Select -First 1 -ExpandProperty FullName

$outfile = "-o$dir"

cmd /c "$7zip e $tfile $outfile *\var\log\auth.log -r -y"

cmd /c "$7zip e $tfile $outfile *\var\log\shell.log -r -y"

Get-Item -Path $tfile | Remove-Item -Confirm:$false

Get-Item -Path $file | Remove-Item -Confirm:$false

Disconnect-VIServer -Server $esx -Confirm:$false

[Sivaramsharmar]

Hi Lucd,

Thanks Script works fine.

[Sivaramsharmar]

Hi Lucd,

Can you please direct me to any article which explain about New-object as well New-Viproperty with explanation and examples.

[LucD]

For the New-Object cmdlet, there is a great post by Don Jones, called Windows PowerShell: The Many Ways to a Custom Object

For the New-VIProperty cmdlet have a look at the post called http://blogs.vmware.com/PowerCLI/2013/01/lets-make-new-viproperty-easier.htmlLet’s Make New-VIProperty Easier, which not only introduces an interesting Fling, but also has a list of pointers to other blog posts.

[Sivaramsharmar]

Thanks Lucd.