How to find which vCenter is managing an ESXi host

Method 1: Login to the host using vSphere client

Using vSphere client, login to the host as root. A pop up will warn you the host is being managed by vCenter along with the IP address of the vCenter. Lame? But it works.

Method 2: grep authd /var/log/vmauthd.log

ssh to the host as root and run

grep authd /var/log/vmauthd.log

In the output, look for lines that look like

2016-03-24T15:05:32Z vmauthd[66164776]: authd| I120: Connect from remote socket (IP_ADDRESS:PORT).
2016-03-24T15:05:32Z vmauthd[66164776]: authd| I120: Connect from IP_ADDRESS
2016-03-24T15:05:32Z vmauthd[66164776]: authd| I120: local verification as root
2016-03-24T15:05:32Z vmauthd[66164776]: authd| I120: login from IP_ADDRESS as XXXXXXXXXXXXXXXXXX

The IP_ADDRESS is your vCenter.

Method 3: Listen to the chat between host and vCenter

    ~ # tcpdump-uw dst port 902
    tcpdump-uw: verbose output suppressed, use -v or -vv for full protocol decode
    listening on vmk0, link-type EN10MB (Ethernet), capture size 96 bytes
    13:15:39.717417 IP truncated-ip - 12 bytes missing! esxi.example.com.32086 > vcenter.example.com.902: UDP, length 66
    13:15:49.718347 IP truncated-ip - 12 bytes missing! esxi.example.com.18650 > vcenter.example.com.902: UDP, length 66
    13:15:59.719955 IP truncated-ip - 12 bytes missing! esxi.example.com.com.21201 > vcenter.example.com.902: UDP, length 66
    tcpdump-uw: pcap_loop: recvfrom: Interrupted system call
    3 packets captured
    3 packets received by filter
    0 packets dropped by kernel

Managed hosts send a regular heartbeat over UDP port 902 to the vCenter Server system.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s