VMware Cloud Community
mabedfo
Contributor
Contributor

'User root@127.0.0.1 logged in' is this normal?

Hi guys,

I raised a support ticket asking if this is normal and they came back saying this is perfectly normal and everyone receives it, it seems strange as it floods all my logs with it.

On the 'Events' page in the Virtual Infrastructre client I get this repeating all the time every second, sometimes breaks for 10 seconds then resumes:

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

User root@127.0.0.1 logged in

User root logged out

We have SSH login as Root as default (disabled)

All our 5 Hosts are ESX 3.0.1

VC is 2.0.1 build 32042

VC Logging level is set to 'Info (Normal logging)

We have nothing installed on the consoles apart from the latest version of HP System Management Homepage for VMware 3

Does everyone else see this all the time like VMware support told me? its not that I dont beleive them it's just that it dosent seem right flooding the logs like it does.

Reply
0 Kudos
11 Replies
jesse_gardner
Enthusiast
Enthusiast

I do see these Events on many(all?) of my ESX hosts, which trickles up to the Cluster event log. As someone mentioned in your other thread, it does seem to be related to making VM configuration changes.

Reply
0 Kudos
Paul_Lalonde
Commander
Commander

The root account handles the system changes required by Virtual Center. The vpxd service directs its instructions to hostd which then get executed by the root account on the local ESX box.

Paul

Reply
0 Kudos
maagdenberg
Contributor
Contributor

Hello Paul, is there a way to prevent these events to be logged? we have s SIM agent that is filling up teh VC DB and we need to know how to get rid of these events.

regards,

Andre Maagdenberg

Reply
0 Kudos
heybuzzz
Enthusiast
Enthusiast

I also get them and called support. They said it was normal.....

Reply
0 Kudos
GeorgeZhou
Contributor
Contributor

I have a different username mydomain\myuser@127.0.0.1 logged in and immediately logged out, forgot where is the mydomain\myuser used, between host and vcenter somewhere? anyone give a hint?

btw I asked the vmware support, he called me back and doesn't know where to check, ridiculous.

Reply
0 Kudos
legisilver
Contributor
Contributor

Has anyone heard anything else from Vmware on this?  Flooded logs are Definitely Not normal behavior, no matter what they say.  We at least deserve an option to hide these completely unimportant events.

VMware, where are you?

Reply
0 Kudos
bruno_m_nunes
Contributor
Contributor

Hello,

Anyone have the solution that resolves this issue?

Thanks

Reply
0 Kudos
RParker
Immortal
Immortal

All it means is that someone logged in at the console for vcenter.  What is the problem?

Reply
0 Kudos
bruno_m_nunes
Contributor
Contributor

There is no problem, but isn't someone, it's the root account and it's constantly like this

User root@10.227.21.23 logged in
info
14-10-2011 10:47:52
root

User root logged out
info
14-10-2011 10:46:51
root

User root@10.227.21.23 logged in
info
14-10-2011 10:45:51
root

User root logged out
info
14-10-2011 10:44:51
root

User root@10.227.21.23 logged in
info
14-10-2011 10:43:51
root

This isn't a problem but it seams that the vcenter (10.227.21.23) is trying to do something and can't do it.

Reply
0 Kudos
NealSu
Contributor
Contributor

Hi everyone,

we had a similar or maybe even the same issue in our environment. We are currently using VMware 4.0 U3.

These events were caused by cronjobs specified in /etc/cron.minutely/ on every one of our ESX-Hosts. After removing all those jobs, all of these events have ceased to pop up so far (it's been one day) and we would usually see them almost every second.

Thus you should check whether you have any cronjobs running.

Regards,

Neal

typo

Reply
0 Kudos
milton123
Hot Shot
Hot Shot

Here is the same problem!!!

Cheers, Yours Udin

Reply
0 Kudos