WilliamLam.com

CIM monitoring caveat with ESXi

by // 9 Comments

I recently started to play around with the CIM API to monitor the hardware on an ESXi host. Instead of relying on hardware agents/scripts that would normaly run in the traditional Service Console of ESX, CIM is an API that allows you to monitor the health of your ESX or ESXi host. You can see the health status of your host by logging directly into the ESX(i) host using the vSphere Client and clicking on Configuration->Health Status tab.

I decided to start off with a small python script that would run on vMA and using the wbem python module to make a simple connection to query for the ESXi version. Here are the steps to get the following script working:

1. Download pywbem onto vMA

2. Extract the contents of pywbem

tar -zxvf pywbem-0.7.0.tar.gz

3. Install pywbem

sudo python setup.py install

4. The script expects the hostname/IP of your ESX(i) host as it's first argument and the username as the second argument and then you will be prompted for the password

./cim.py himalaya.primp-industries.com root

If everything went according plan, you should see the version of your ESX(i) host printed on the screen.

Next I wanted to create a dedicated service account so that I do not have to use the root account, I thought a read-only role would suffice.

To my surprise, when I ran the script again with this user, I received an unauthorized access error.

At first I thought the user account required an "Administrator" role to perform the operation but after further investigation, I found that the user account must be part of the "root" user group. Even for a read operation, it still needed to be in that that group.

After I made the change using the vSphere Client and re-ran the script, it executed as I expected.

After speaking to someone at VMware regarding this issue, it was confirmed by engineering that this is in fact a software bug and it should not require the user account to be part of the "root" user group to query from the CIM API.

I was still interested in using CIM, but I wanted to lock down the account as much as possible and came up with the following snippet of code which can be included in your ESX(i) kickstart configuration.

The script creates a regular user who does NOT have login access to the ESX(i) host. It then puts the user into the "root" user group and then creates a new role called CIM with a single privilege Host.Cim.CimInteraction and then associates this user with this role.This ensures that the account can only perform read-only operations against the CIM API and does not allow for host logins. Until the bug is resolved, this should be an acceptable work around.

So what type of monitoring can you do with CIM? Well pretty much anything and everything. There is a popular Nagios script that monitors the hardware health of an ESXi host using the CIM API called check_esxi_webem.py that one can implement to alert on your hardware components.

The script currently expects three arguments: hostname/IP of ESX(i) host, username and password on the command line (this can be changed with minor modifications). If you run it using those defaults, you will either get an OK or WARN/ERROR which will include additional information about the component that is alarming.

If you would like to get more details on the components being checked, you can pass in a fourth parameter called "verbose" and the script will provide more information on what is being checked.

If you are not big on python, there is also a Perl SDK for CIM/WSMAN as part of the vCLI installation and if you are using vMA, you can find some great examples under /usr/share/doc/vmware-vcli/samples/WSMan

The checksensorhealth.pl is definitely one to take a look at, here is an example output:

If you are interested to learn more about CIM, take a look at the these resources:
CIM SDK
7 Part series on ESXi Chronicles blogs about CIM and hardware monitoring

How to mount a cdrom using vsish on ESXi

by // 17 Comments

While browsing the VMTN community forums today, I noticed a very interesting post about mounting the CD-ROM device from within ESXi. The solution involved the use of vsish as the traditional mount utility did not function as expected in the Busybox Console of ESXi. I thought this was a very clever solution and might be worth sharing for those that may have similar needs.

Note: This trick looks like it only works with ESXi 4.1, as previous releases of ESXi may not include the iso9660 VMkernel module.

First you will need to load a VMkernel module: iso9660 which will allow you to mount and access the CD-ROM device.

You will need to run the following command:

vmkload_mod iso9660

You should see a successful message after the module has loaded:

Note: To see a list of VMkernel modules that can be loaded/unloaded, take a look at /usr/lib/vmware/vmkmod

Next you will need to identify the path to your CD-ROM device, you can do so by using the esxcfg-mpath utility.

You can run the following shorthand command to locate the path:

esxcfg-mpath -b | grep "CD-ROM"

You should see something in the form of mpx.*:

Now we will use vsish to perform the mount operation. Before we get started, if you did not perform the VMkernel module load of iso9660, you would not see the following path in /vmkModules/iso9660. Once the module has been loaded, you can perform a "ls" (listing) of the operations supported by this module which is mount and umount. You will need to run a "set" operation on the "mount" command and specify the device in which you would like to mount.

You will need to run the following command:

vsish -e set /vmkModules/iso9660/mount $(esxcfg-mpath -b | grep "CD-ROM" | awk '{print $1}')

If you do not see any messages after executing the command, it was successful, else you may see an error/warning for incorrect syntax.

The CD-ROM device will automatically be mounted under /vmfs/volumes/mpx.* and there will also be a symlink with the CD-ROM label. In this example, I mounted an ESXi 4.1 Update 1 ISO file.

We can change into the directory to confirm we actually have the CD-ROM device mounted and list the contents.

Once you are done with your task, to umount is the same syntax except you will be using the "umount" operation. You can unmount by using the following command:

vsish -e set /vmkModules/iso9660/umount $(esxcfg-mpath -b | grep "CD-ROM" | awk '{print $1}')

Another alternative is to mount the image on another system and copy the contents to your ESXi host, but if you only had your ESXi host and needed to pull something from a CD-ROM, this is how you would do it.

Thanks again to agodwin for sharing this tidbit.

How to install Ruby vSphere Console on vMA

by // 5 Comments

If you are a Ruby and VMware fan (heck, even if you are not a Ruby fan), you should check out the "unofficial" VMware Lab Fling - Ruby vSphere Console (RVC) created by Rich Lane of VMware. RVC is described as a Linux console UI for vSphere, built on the RbVmomi (another VMware Fling) bindings to the vSphere API. RVC is platform agnostic, as long as you can get Ruby/Gem installed, you can run RVC on Windows (I believe), UNIX/Linux and even OSX!

Rich just released another update today supporting Linked Clones functionality for virtual machines and maintenance mode for ESX(i) host. I wanted to check out the latest update and I thought give it a try on vMA, here are the instructions for installing Ruby, Gem (Ruby package manager) and RVC on vMA 4.1. If you do not want to manually go through this manual process, jump towards the bottom for an automated script that does all this for you 🙂

Step 1 - You will need to download a few dependencies for both Ruby and Gems, the easiest way to do so is to setup a YUM repo pointing to CentOS mirrors. You will need to create a .repo file under /etc/yum.repos.d and in this example, we'll just call it /etc/yum.repos.d/CentOS-Base.repo

Copy the following into this file, make sure you create the file using sudo:

Step 2 - Install the following packages:

yum -y install gcc gcc-c++ zlib-devel openssl-devel readline-devel libxml2 libxml2-devel libxslt libxslt-devel

Step 3 - Download Ruby and Gems using wget:

wget ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7.tar.gz
wget http://rubyforge.org/frs/download.php/74619/rubygems-1.7.2.tgz

Step 4 - Install Ruby

tar -zxvf ruby-1.8.7.tar.gz
cd ruby-1.8.7
./configure
make
sudo make install
cd ..

You can verify that Ruby was installed correctly by running the following:

[vi-admin@vMA rubygems-1.7.2]$ ruby --version
ruby 1.8.7 (2008-05-31 patchlevel 0) [x86_64-linux]

Step 5 - Install Gem

tar -zxvf rubygems-1.7.2.tgz
cd rubygems-1.7.2
sudo ruby setup.rb

You can verify that Gem was installed correctly by running the following:

[vi-admin@vMA rubygems-1.7.2]$ gem --version
1.7.2

Step 6 - Update Gem (not necessary if you downloaded the latest version which is 1.7.2)

sudo gem update --system

Step 7 - Install ffi gem, this is used for faster tab competition

sudo gem install ffi

Step 8 - Install Ruby vSphere Console (RVC) gem

sudo gem install rvc

You can verify that RVC was installed correctly by running the following command:

[vi-admin@vMA ~]$ rvc -h
Ruby vSphere Console.

I also wrote a quick RVC installation script which does exactly the above without the manual labor.

Step 1 - Download installRVC.sh script to vMA:

wget http://vghetto.svn.sourceforge.net/viewvc/vghetto/other/installRVC.sh

Step 2 - Set the script to be executable:

chmod +x installRVC.sh

Step 3 - Run the installation script

sudo ./installRVC.sh

Once completed, you should get a successful message that RVC is installed on your vMA host.

Now you are ready to start playing with RVC!

Here is an example of the two latest features added by Rich

Linked Clone:

Maintenance Mode:

As you can see it is very easy to use and intuitive, what would be even cooler is to have the various objects be colorized so you can easily distinguish between them, perhaps feature enhancement Rich?

If there are other vSphere operations that you would like to see get implemented, drop your feedback on this VMTN thread which is being monitored by Rich. You can also follow Rich on twitter for the latest updates about RVC.

Hopefully VMware will make this into an official fling and put it on their VMware Lab's website to get the word out!