WilliamLam.com

Retrieving CPU Microcode revision from ESXi in vSphere 8.0 Update 3

by // Leave a Comment

Whether you are applying a CPU microcode update through a hardware vendor's BIOS update or an ESXi update/upgrade, verifying the CPU microcode revision within ESXi is not as easy as it could be.

Today, if you wanted to get the current CPU microcode revision from ESXi, you would need to enable SSH and then use the vsish interface to retrieve this information by running the following command:

vsish -e cat /hardware/cpu/cpuList/0 | grep "microcode" -A2

While you can retrieve the CPU microcode revision, the method and required interfaces was less than ideal, especially at scale. Given ESXi already exposes a number CPU attributes via the ESXCLI interface, which includes programmatic access when using PowerCLI, I thought it would be a nice feature to also include the CPU microcode revision as part of the output and had filed an internal feature enhancement a few years back.

[Read more...]

Minimum vSphere privileges to install or remove patch from ESXi

by // Leave a Comment

I recently got a question from our field inquiring about the minimum vSphere privileges that would be required to either install or remove a patch (VIB/Component) from an ESXi host. The customer was interested in using PowerCLI and specifically the ESXLI interface to automate the installation and removal of a VIB and wanted to create a custom vSphere Role with the minimum privileges, which can be done with vCenter Server or even a standalone ESXi host (properly licensed).

Since I was familiar with the underlying ESXi patch API that is used for these operations, a nice benefit of the vSphere API Reference is that it also lists the specific vSphere Privileges that is required for a given operation and in this case, it is just Host.Config.Patch privilege.

However, when the customer attempted to create a custom vSphere Role with just this privilege and perform the installation operation, they still received an error as shown in the screenshot below, which was a bit cryptic but they had assumed it was still permissions related as full administrative account had worked:

OperationStopped: Response status code does not indicate success: 500 (Internal Server Error)


[Read more...]

Quick Tip - New remote version of ESXCLI 8.x

by // Leave a Comment

I was recently made aware of a nice update from our developers that we now have a new version of the remote ESXCLI utility that is much simpler to install across any operating system and is fully backwards compatibility with ESXi hosts running 6.7.x, 7.x and 8.x.

Many of you are probably familiar with the local version of ESXCLI which is available when connecting to ESXi whether that is over SSH or directly in the ESXi Console. However, a remote version of ESXCLI has been available since the introduction of ESXCLI back in vSphere 4.0, but surprisingly, I still come across users who never knew that this was possible!

In the past, the remote version of ESXCLI was platform specific and it was distributed in a number of diffrent ways from being bundled as part of the vSphere CLI (6.7) to being a standalone download (7.0) and this inconsistency brought many challenges, not just from an internal development standpoint but also operationally for users who needed to deploy this utility across their administrative systems.

[Read more...]