VMware vSphere

Hi all,

last night we had a problem with 2 esxi hosts, unexpected shutdown.

On vcenter logs we found this event:

It seems an user action shutdown with vsphere.local\admin account but we can't find other info (source ip,....).

Where can i found other info about it ?

Thanks a lot !!

Bye.

With all the events occurring at the same time, I'd assume it's some kind of tool, or script which triggers the shutdown (e.g. an UPS).

See whether /var/log/audit/sso-events/audit_events.log contains details about the login.

André

Hi Andrè,

i've found a login 2 minutes before the shutdown action as show:

but I'm not able to find the source of logon. The /var/log/audit/sso-events path doesn't exists on vcenter appliance :smileysad:

Thanks.

Hi,

Mastering vSphere 6.5 - vCenter Logs - Technorians

ARomeo