'User root@127.0.0.1 logged in' is this normal?

[mabedfo]

Hi guys,

I raised a support ticket asking if this is normal and they came back saying this is perfectly normal and everyone receives it, it seems strange as it floods all my logs with it.

On the 'Events' page in the Virtual Infrastructre client I get this repeating all the time every second, sometimes breaks for 10 seconds then resumes:

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

We have SSH login as Root as default (disabled)

All our 5 Hosts are ESX 3.0.1

VC is 2.0.1 build 32042

VC Logging level is set to 'Info (Normal logging)

We have nothing installed on the consoles apart from the latest version of HP System Management Homepage for VMware 3

Does everyone else see this all the time like VMware support told me? its not that I dont beleive them it's just that it dosent seem right flooding the logs like it does.

[jesse_gardner]

I do see these Events on many(all?) of my ESX hosts, which trickles up to the Cluster event log. As someone mentioned in your other thread, it does seem to be related to making VM configuration changes.

[Paul_Lalonde]

The root account handles the system changes required by Virtual Center. The vpxd service directs its instructions to hostd which then get executed by the root account on the local ESX box.

Paul

[maagdenberg]

Hello Paul, is there a way to prevent these events to be logged? we have s SIM agent that is filling up teh VC DB and we need to know how to get rid of these events.

regards,

Andre Maagdenberg

[heybuzzz]

I also get them and called support. They said it was normal.....

[GeorgeZhou]

I have a different username mydomain\myuser@127.0.0.1 logged in and immediately logged out, forgot where is the mydomain\myuser used, between host and vcenter somewhere? anyone give a hint?

btw I asked the vmware support, he called me back and doesn't know where to check, ridiculous.

[legisilver]

Has anyone heard anything else from Vmware on this?  Flooded logs are Definitely Not normal behavior, no matter what they say.  We at least deserve an option to hide these completely unimportant events.

VMware, where are you?

[bruno_m_nunes]

Hello,

Anyone have the solution that resolves this issue?

Thanks

[RParker]

All it means is that someone logged in at the console for vcenter.  What is the problem?

[bruno_m_nunes]

There is no problem, but isn't someone, it's the root account and it's constantly like this

User root@10.227.21.23 logged in
info
14-10-2011 10:47:52
root

User root logged out
info
14-10-2011 10:46:51
root

User root@10.227.21.23 logged in
info
14-10-2011 10:45:51
root

User root logged out
info
14-10-2011 10:44:51
root

User root@10.227.21.23 logged in
info
14-10-2011 10:43:51
root

This isn't a problem but it seams that the vcenter (10.227.21.23) is trying to do something and can't do it.

[NealSu]

Hi everyone,

we had a similar or maybe even the same issue in our environment. We are currently using VMware 4.0 U3.

These events were caused by cronjobs specified in /etc/cron.minutely/ on every one of our ESX-Hosts. After removing all those jobs, all of these events have ceased to pop up so far (it's been one day) and we would usually see them almost every second.

Thus you should check whether you have any cronjobs running.

Regards,

Neal

typo

[milton123]

Here is the same problem!!!

Cheers, Yours Udin