Auditing ESX DCUI Logins

For troubleshooting purposes, users may need to access the ESXi Direct Console User Interface (DCUI), either remotely through an out-of-band system like an iDRAC or iLO, or directly from the physical server.

For auditing purposes, all login methods to ESXi (SSH, API, Host Client, and DCUI) are recorded, and a corresponding vSphere Event called UserLoginSessionEvent is generated for easy filtering.

Like all vSphere Events, you can either view them directly on an ESX host or centrally using vCenter Server or even VCF Operations.

We can also use the vSphere API via PowerCLI to quickly filter out the DCUI specific login events using the following snippet:

$dcuiLogins = Get-VIEvent -User "dcui" -MaxSamples 1000 | Where { $_.GetType().Name -eq "UserLoginSessionEvent" -and $_.FullFormattedMessage -match "[email protected] logged in as VMware-client/9"}

$results = @()
foreach ($dcuiLogin in $dcuiLogins) {
    $tmp = [pscustomobject] [ordered]@{
        Cluster = $dcuiLogin.ComputeResource.Name
        Host = $dcuiLogin.Host.Name
        Date = $dcuiLogin.CreatedTime
    }
    $results += $tmp
}

$results | Sort-Object -Property Date -Descending

Here is an example output where we retrieve the latest 1000 events and then output the vSphere Cluster and ESX host, sorted by the latest login time.