ESXi. The command line and shell magic
ESXi is a type-1 hypervisor, meaning it runs directly on system hardware without the need for an operating system (OS). Type-1 hypervisors are also referred to as bare-metal hypervisors because they run directly on hardware.
VMware provides a powerful and convenient graphical interface for managing ESXi servers.
In this case, using the command line interface (CLI) is what you need – it is possible to configure all settings, including the hidden ones in the command line which is also referred to as the console. In addition to traditional commands that are the same in Linux and ESXi, ESXi has its own ESXCLI commands.
ESXCLI is a part of the ESXi shell, this is a CLI framework intended to manage a virtual infrastructure (ESXi components such as hardware, network, storage, etc.) and control ESXi itself on the low level. All ESXCLI commands must be run in the ESXi shell (console). Generally, ESXCLI is the command that has a wide list of subcommands called namespaces and their options. The ESXCLI command is present right after ESXi installation along with other ESXi shell commands. Notice that ESXCLI commands are case-sensitive, similarly to other console commands used in ESXi.
The ESXCLI log file is located in /var/log/esxcli.log .
The data is written to this file if an ESXCLI command has not been executed successfully. If an ESXCLI command is run successfully, nothing is written to this log file.
The most useful ESXCLI commands are explained in today’s blog post.
Environment
In this article I have VMware ESXi Hypervisor 6.7 U3 (Free version)
Usage
How to open the CLI in ESXi?
By default, ESXi shell is disabled for local and remote access; hence, you are not able to run ESXi shell commands until you enable the ESXi shell. VMware has made this restriction for security reasons.
You can enable this with local command line direct connected to ESXi host (named DCUI) or with WebGUI (throw web-browser).
Using the ESXi default interface. In the ESXi Direct Console User Interface (DCUI), go to Troubleshooting Options , navigate to Enable ESXi Shell and Enable SSH strings and press Enter to enable each option.
After enabling the ESXi shell, press Alt+F1 to open the console on the machine running ESXi. You should enter your login and password after that (credentials of the root user can be used). If you need to go back to the ESXi DCUI, press Alt+F2.
The Enable SSH option allows you to open the ESXi console remotely by using an SSH client.
Command list
The entire list of all available ESXCLI namespaces and commands is displayed after running the command:
Checking hardware
To view installed PCI devices, run the following ESXCLI command:
Check the amount of memory installed on the ESXi server:
View the detailed information about installed processors:
Change a hostname
Run these commands to change the hostname:
Power control ESXi host
Power off an ESXi host:
The command for rebooting the host is similar. To write a reason of rebooting use -r :
Start and stop VM
The basic command to control the virtual machines is
To list all virtual machines run:
To work with individual VMs you need the <ID> provided by the previous command.
To get a summary of the machine run (where <ID> is a number):
To power on/power off/suspend a VM run:
Stop VM via esxcli
Use this to forcibly stop a virtual machine.
List all running virtual machines on the system to see the World ID of the virtual machine that you want to stop.
Stop the virtual machine by running the following command.
The command supports three —type options. The following types are supported through the —type option:
- soft . Gives the VMX process a chance to shut down cleanly (like kill or kill -SIGTERM)
- hard . Stops the VMX process immediately (like kill -9 or kill -SIGKILL)
- force . Stops the VMX process when other options do not work.
Autostart of VM
Get a list of virtual machine IDs:
Enable force autostart feature:
Now check the VMs startup settings:
Make sure that the startAction value of the VM has changed to powerOn .
Uplink of vSwitch
For example you have one physical nic on your ESX then that called vmnic0 . If you have one vSwitch it will be called vSwitch0 .
To list your vSwitch run:
If you have no vmnic or are missing the one that you want to use for the management network then you need to add it by using the following command:
Replace vmnic0 with your vmnic and same for the switch.
So if I wanted to remove vmnic0 from vSwitch0 I would use the following command:
Enter to maintenance mode
Enter the host to the maintenance mode.
Get currently status of the host
Backup configuration
Using the ESXi Command Line to Back up ESXi Host. You don’t need to install any additional software to use the ESXi command line. You have to enable ESXi shell and remote SSH access to an ESXi host. Once you have connected to your ESXi host via SSH, you can run the commands.
ESXi configuration is saved every hour automatically to the /bootblank/state.tgz file. For this reason, you should ensure that the current ESXi configuration is written to ESXi configuration files right now to confirm that all changes made to ESXi configuration since the last autosave are saved:
Back up ESXi configuration:
As a result, you’ll receive a link to download the configBundle.tgz archive from the ESXi host. You should replace the asterisk with the IP address of your ESXi host. The archive file that contains the ESXi configuration backup is saved to the /scratch/downloads directory. The scratch partition was mentioned in the blog post about installing ESXi on a USB Flash drive.
Restore configuration
You should have ESXi of the same version and build number installed on the machine where you want to restore the ESXi configuration. The UUID must be the same on both the ESXi server that was backed up and the ESXi server on which the configuration must be restored (can be obtained using the command esxcfg-info -u ).
Use numeric 1 as force option to override the UUID mismatch. For example, vim-cmd hostsvc/firmware/restore_config 1 /tmp/configBundle.tgz . The UUID value of the backed up ESXi host is mentioned in the Manifest.txt file inside the configBundle.tgz backup archive.
Once you have prepared your freshly installed ESXi host to restore ESXi configuration from a backup, connect to the ESXi host via SSH and enter the host to the maintenance mode.
Copy the archive that contains the ESXi configuration backup configBundle-xxxx.tgz archive from a local machine to the /tmp/ directory on the destination ESXi server.
Rename the configBundle-xxxx.tgz file to configBundle.tgz before you enter a command to restore ESXi configuration. Otherwise you will get an error message: File /tmp/configBundle.tgz was not found.
Restore the ESXi configuration:
After running this command an ESXi host will be rebooted automatically.
Login to console by SSH rsa key
You should have a SSH key on the host that you would like to connect to ESXi. So I think you already know how to generate ssh-keys, I just write command to add keys to the ESXi host — esxi.machine.com .
Configuring Login Behavior
ESXi has a good security feature to add a root account lockout for safety. After a number of failed login attempts, the server will trigger a lockout. By default, a maximum of five failed attempts is allowed before the account is locked. The account is unlocked after 15 minutes by default.
You can configure the login behavior for your ESXi host with the following advanced options:
- Security.AccountLockFailures — Maximum number of failed login attempts before a user’s account is locked. Zero disables account locking.
- Security.AccountUnlockTime — Number of seconds that a user is locked out.
Remote access for ESXi local user account ‘root’ has been locked for 120 seconds after xxx failed login attempts.
Are you seeing this message? Do not worry, you are in the right place. Now, let’s look at what to do if your ESXi root account is locked. The command line to clear the lockout status and reset the count to zero for an account is shown here with the root account as an example:
Conclusion
Today’s blog post has covered a series of ESXi shell commands. Using the command line interface gives you more power in addition to WebGUI. You can use ESXi shell commands for viewing and configuring settings that are hidden or not available in the GUI. Use the ESXi shell commands list provided in this blog post for fine ESXi tuning.
Additional information
-
— Backup and restore instructions from Nakivo. — A one of explanation of the most often used ESXi shell commands from Nakivo. — How to back up and restore the ESXi host from VMWare. — Another manual instruction to this. This one from graspingtech. — On Russian language. — Some information about starting VM process, and how to do it with cmd
Categories: sysad
Updated: May 21, 2020
You May Also Enjoy
Hacking. Wi-Fi Deauthentification attack on MacOS
Probably all Apple computers with wireless cards are capable to use monitoring and de-authentication mode. BetterCAP is an amazing, adaptable, and convenient.
DELL. Configure Dell 10 gigabit switch with Ansible
Use Ansible playbooks to easy configure Dell Networking OS9 system. The post contains many practical examples of using dellos9 modules
DELL. Upgrade firmware on Dell S4048 switch (S-series, OS9)
Instructions for upgrading the last firmware of Dell Networking system.
DELL. Disabling SupportAssist on switch
SupportAssist is a daemon for sending technical reports to Dell servers. It enables by default. Here we disable this unwanted feature (and may be unsecured).
Troubleshooting with ESXi Shell
The ESXi Shell gives us a subset of commands for troubleshooting and managing individual ESXi hosts. ESXi Shell can be useful to quickly investigate and resolve issues with single hosts, for example if management agents are unresponsive. This section will cover how to enable ESXi Shell, how to access the ESXi Shell, and how to use the ESXi Shell. It is important to remember that when the ESXi Shell and SSH services are enabled you are potentially opening up vulnerabilities to which attackers may be able to use maliciously. For this reason you will see a warning on any hosts in the web client when the ESXi Shell and / or SSH service is enabled. You can suppress the ESXi Shell warning by following this kb. Remember to disable the ESXi Shell when you have finished, it is also possible to configure time-outs when enabling the ESXi Shell; availability time-out to determine how long ESXi Shell is enabled for, and idle time-out to determine how long idle sessions are kept connected.
You can remotely manage multiple hosts using the vSphere Management Assistant, for more information see the vSphere Management Assistant Guide.
Enabling ESXi Shell
By default the ESXi Shell is disabled, it can be enabled using the DCUI or web client (local or vSphere).
- DCUI (Direct Console User Interface)
- Access the console of the ESXi host by plugging in a monitor and keyboard, or establishing a remote console session using remote server tools such as ILO, IMM, etc.
- Press F2 and enter the root password. Browse to Troubleshooting Options.
- Select ESXi Shell and press Enter to toggle between enabled and disabled. If you are going to access the Shell locally this is sufficient, for remote connections you must also enable SSH.
- Press Esc twice to exit out of the menus.
- ESXi host web client (standalone hosts v6.5 and above)
- Browse to the IP address of FQDN of the host and log in with the root password.
- From the Navigation menu select Manage, and open the Services tab.
- Locate and Start TSM for the ESXi Shell, and TSM-SSH for SSH if required.
- vSphere web client (hosts connected to vCenter Server)
- Browse to the IP address or FQDN of the vCenter Server and log in with an administrator account.
- Locate the host in the inventory and select the Configure tab.
- Scroll down to the Security Profile menu under System.
- Click Edit and start the Direct Console UI, ESXi Shell, and SSH services.
Access ESXi Shell
Once enabled, the ESXi Shell can be accessed locally using the DCUI or remotely over SSH.
- For DCUI access to the ESXi Shell press ALT + F1 from the ESXi console screen. Log in with the root password.
- For remote access open a connection over port 22 using an SSH client such as Putty, and log in with the root password.
Using ESXi Shell
The ESXi Shell contains the full range of esxcli and esxtop commands, as well as esxcfg for legacy purposes (although be aware that esxcfg is depreciated and may be phased out in future releases). The ESXi Shell is useful for performing maintenance and troubleshooting individual hosts, it cannot be used for scheduling scripting jobs. For managing multiple hosts and scripting use vSphere CLI (vCLI) either as a local installation or with the vSphere Management Assistant (vMA).
Have a look in /usr/sbin to view the available commands for the ESXi Shell; enter cd /usr/sbin and then ls. Note that commands are case sensitive.
esxtop is a powerful utility for examining ESXi host performance metrics and investigating performance issues. In the ESXi Shell enter esxtop with variables such as c for CPU, m for memory, n for network, and d for disk, read more in the Troubleshooting with ESXTOP post.
esxcli is a comprehensive set of commands for managing the vSphere environment. The command set is broken down into namespaces, to view the available namespaces use the esxcli command.
This propogates down the chain, for example use esxcli storage to view the options within the storage namespace. You can use –help at any level of esxcli for assistance.
You can view a full list of esxcli commands by entering esxcli esxcli command list. The screenshot below has been cropped and isn’t a full list, it may be beneficial to drill down through the relevant individual sections using the method outlined above.
As you can see the range of esxcli commands is vast, let’s take a look at a few examples.
- esxcli hardware allows us to view and change the physical server hardware information and configuration. Use esxcli hardware cpu global set to enable or disable hyperthreading.
- esxcli system allows us to view and change the ESXi system configuration. To enable or disable maintenance mode use esxcli system maintenanceMode set.
- esxcli storage can be used for storage related tasks, use esxcli storage core path list to view attached LUNs, or esxcli storage vmfs upgrade to upgrade VMFS.
- esxcli network allows us to perform network related tasks, use esxcli network vswitch standard to create a new standard virtual switch.
To exit the ESXi Shell use the exit command. Hopefully this post provides enough to get you started, if you are using ESXi Shell on a regular basis and want to view previously executed commands see this post by William Lam. For details on patching or upgrading ESXi from the command line see the ESXi Command Line Upgrades post.
VMware ESXi
This page has been archived and will receive no further updates.
Misc commands
(to be used with SSH–see below for enabling SSH)
Test connectivity (telnet isn’t available)
List VMs (get vmIds):
VM status:
Power on/off a VM:
Get the IP address of a VM:
To list available commands:
Standard VM operations:
Remove a VM:
Then delete the vm directory from the datastore (/vmfs/…)
Maintenance mode for ESX host:
Note: unfortunately this command will not evacuate/VMotion your VMs to rest of the cluster
Show the DCUI (direct console user interface)
Installation
Installation Problems
If you get an error stating you need to Disable the CPUID value or enable legacy OS support:
- At the initial bootloader screen (when booting from the ISO), press TAB to edit the boot options
- Hold down the left-arrow key to move the cursor back to the beginning of the boot options, and add “nocheckCPUIDLimit” right after “vmkernel.gz”, so that the first part of the boot options BEFORE the first “—” reads: “mboot.c32 vmkernel.gz nocheckCPUIDLimit —”
- In the new ESXi 4.0 bootloader, more modules have been added to the list, including a vmkboot.gz, which now loads before the vmkernel.gz module. This means the correct loader syntax would actually read: mboot.c32 vmkboot.gz nocheckCPUIDLimit — vmkernel.gz — [etc].
Enter the license
Select the host > Configuration > Software > Licensed Features > ESX Server License Type > Edit… > Assign a new license key to this host > Enter Key… > (enter key) > OK
To get to a terminal
- At main ESXi screen, press Alt-F1
- Type “unsupported”
- Type in root password
Enable SSH (from terminal)
- Edit /etc/inetd.conf
Add non-root user as an admin
- Log in to infrastructure client
- Select the host icon
- In the right side of the screen, click on the “Users & Groups” tab
- Right-click in the window, click Add…
- Type in a login (and optionally user name)
- Type a password
- Type “root” into the Group box and click Add
- Type “localadmin” into the Group box and click Add
- Click OK
- Click on the Permissions tab
- Right-click in the window, click Add Permission…
- In the left side of the screen, click Add
- Select username, click Add, OK
- In the dropdown box on the right, choose Administrator, then click OK
Set up SSH for non-root users
- Log in to the console
- Edit the inetd.conf
- Change the home directory from /home/[user] to /
- Change the login from /bin/false or /bin/nologin to /bin/ash
- Save the file
Now you can log in with SSH using your new unprivileged user Use su — to change to the root user.
Set up useful scripts
(Thanks Josh for the improvements)
chmod 744 /opt/get*.sh
Set up ESXi to do DHCP with a hostname
Warning: use caution when following these instructions so you don’t accidentally duplicate an IP
Utilize Direct Console User Interface (DCUI) and ESXi Shell to Troubleshoot, Configure, and Monitor ESXi Networking
This will be a short post, as I don’t want to cover ground I’ve recently written about, but as this is one of the VCAP-DCA objectives, I still wanted to cover it.
The DCUI can be used to configure a host’s networking as documented here. It’s worth mentioning here that you can also access the DCUI console via SSH by typing ‘dcui’ at the CLI prompt:
Other recent posts around using the CLI to configure and troubleshoot host networking include:
A couple of things that I haven’t covered elsewhere are using the DCUI to restore a standard vSwitch, and using the DCUI to reset a host to it’s default configuration. The reset option is available on the main DCUI screen, and is self explanatory:
If you select this option, it will reset the host back to it’s default configuration, removing all network configuration etc as a consequence. You will be asked for confirmation before the config is reset though, in case you are too hasty:
The other DCUI option I wanted to mention was the Network Restore options:
The Restore Network Settings option allows you to restore the management network settings by configuring the management network with system defaults. Choosing this option will stop all running virtual machines on the host. There is also the option available to ‘Restore Standard Switch’. This option will be greyed out unless your management network is connected to a dvSwitch.
You may need to run this if you are having problems with the dvSwitch an this is causing a loss of connectivity to your hosts management network. It may be that you need to fix issues with the dvSwitch, but need to restore host connectivity in the meantime.
When you select this option, a new standard vSwitch will be created on the host, with a new vmkernel interface to which an IP can be assigned. An uplink from the dvSwitch will be moved to the new standard vSwitch. You can read more about this process here.