WilliamLam.com

vCloud Director Report 1.0.0

by // 4 Comments

Over the winter holiday I started to explore the vCloud API and one of our SDKs, vCloud SDK for PHP. VMware provides two additional vCloud SDKs: Java and .NET. I had used Java in college and I wanted to stay away from anything Windows related, so I thought I give PHP a try and it was the closest thing to Perl 😉

Since this was my first time using the vCloud API and SDK, I thought what better way to learn than to create a script similar to my vSphere Health Check Report for vCloud Director? This not only helped me to understand the objects in vCloud Director from an API perspective but no such reporting tool exists today for administrators and end users of vCloud Director.

Here is an example of what a report could look like: vCloudDirectorReport.html

To use the script, you will need the following per-requiste:

  • Install vCloud SDK for PHP, take a look at article on how to get setup.
  • Running vCloud Director 1.5 (Script uses the new API Query Service)
  • Download both config.php which includes configuration parameters for the script and vmwarevCloudDirectorReport.php script.

To get a list of the available commandline options, just type "php vmwarevCloudDirectorReport.php":

php vmwarevCloudDirectorReport.php

Error: missing required parameters
Usage:

[Script]
VMware vCloud Director Report v1.0.0

[Description]
This script provides a detail report of your VMware vCloud Director system

[Usage]
# php vCloudReport.php -s -u -p [Options]

-s|--server [req] IP or hostname of the vCloud Director.
-u|--user [req] User name in the form user@organization for the vCloud Director instance.
-p|--pswd [req] Password for user.
-t|--type [req] Type of report [system|orgadmin|orguser].

[Options]
-r|--report [opt*] Name of html output file (e.g. vCloudReport.html).

[Examples]
# php query.php -s 127.0.0.1 -u admin@system -p password -t system
# php query.php -s 127.0.0.1 -u admin@coke -p password -t orgadmin
# php query.php -s 127.0.0.1 -u admin@pepsi -p password -t orguser

The config.php can be used to store the vCloud URL and credentials or you may specify it via the commandline using -s, -u and -p arguments. In addition, you will also need to specify -t flag which is based on the type of user you are logging into whether that is system (administrator), orgadmin or orguser.

The report can easily be customized by toggling parameters in config.php which includes the following parameters:

Depending on the report type, certain flags will be applicable. By default, all flags are enabled but you my disable ones you do not wish to see.

Here is an example of the script logging into vCloud Director instance with the administrator account in the System organization:

This is the first iteration of the script, I plan on adding additional information and if you have any feedback/suggestions, please leave a comment below.

Using a VNC Client to Connect to VMs in ESXi 5

by // 10 Comments

The ability to connect to a virtual machine using a VNC client has been available since the early days of VMware GSX as described by this VMware KB article. The required .vmx configuration can also be applied to virtual machines running on ESX(i), but is not officially supported by VMware. With ESXi 5, this continues to work but there is one additional caveat users should to be aware of, which is the new firewall that has been introduced in ESXi 5.

In addition to the three .vmx configurations:

  • RemoteDisplay.vnc.enabled = [true|false]
  • RemoteDisplay.vnc.port = [port #]
  • RemoteDisplay.vnc.password = [optional]

Users need to also enable the ports selected for each virtual machine on the ESXi firewall. Here is an example of a firewall rule that needs to be created:

Take a look at this blog post for details on configuring custom firewall rules including persisting the custom rules upon a system reboot.

Here are a few screenshots of configuring the .vmx configurations and using a VNC client to connect to the powered on virtual machine.

Only the first two .vmx configurations are required, if you do not set a password, anyone can connect to the virtual machine as long as they know the hostname/IP Address of your ESX(i) host and port.

To connect to a specific virtual machine, you will specify the hostname/IP Address of the ESX(i) host and port for the given virtual machine. If you set a password, you will need to also provide that before you can connect.

Please be aware of the limitations and security concerns of using VNC. VMware Remote Console or standard RDP/SSH should still be considered for virtual machine remote access.

Identifying Idle vCenter Sessions

by // 4 Comments

I recently received a question on how to identify idle vCenter sessions that may stem from a non-active vSphere Client or vSphere API connection. Properly managing sessions to your vCenter Server is as important as knowing who is logging in. If you exhaust the maximum number of connections, you can easily deny login access to other users and/or services that are needed to connect to vCenter Server which can lead to very bad things. In the worse case, you can even prevent administrators from logging into a new session to help terminate any stale/idle connections.

The vSphere API provides a sessionManagement manager to help you manage all sessions, including checking whether a session is still active and terminating a session. I wrote a quick vSphere SDK for Perl script called sessionManagement.pl which allows you to list all sessions for a given vCenter and terminating a a specific session. Every session has a unique sessionKey that the vCenter Server uses to track and it provides information such username, login time and last active which can be used to create an unattended script to automatically terminate sessions that have gone beyond a certain threshold.

Here is an example script output of performing the "list" operation:

Note: There maybe vCenter Plugins/Extensions that creates sessions such as CapacityIQ, those will be denoted by "vCenter Ext Session" field. These should not be terminated as it can negatively impact 3rd party applications.

Here is an example script output of terminating a specific session using the "disconnect" operation which you will need to specify sessionkey provided in the previous command:

For those of you that are interested in creating your own script to terminate idle sessions, you can use the DateTime Perl module to help with calculating the amount of idle time and comparing that to a pre-defined timeout value.