Hi all,
last night we had a problem with 2 esxi hosts, unexpected shutdown.
On vcenter logs we found this event:
It seems an user action shutdown with vsphere.local\admin account but we can't find other info (source ip,....).
Where can i found other info about it ?
Thanks a lot !!
Bye.
With all the events occurring at the same time, I'd assume it's some kind of tool, or script which triggers the shutdown (e.g. an UPS).
See whether /var/log/audit/sso-events/audit_events.log contains details about the login.
André
Hi Andrè,
i've found a login 2 minutes before the shutdown action as show:
but I'm not able to find the source of logon. The /var/log/audit/sso-events path doesn't exists on vcenter appliance
Thanks.