WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud Foundation
  • VKS
  • Homelab
    • Resources
    • Nested Virtualization
  • VMware Nostalgia
  • Apple

Handy VCSA (vCenter Server Appliance) Operational KB Resources

12.09.2014 by William Lam // 1 Comment

I am a huge fan of the VCSA (vCenter Server Appliance) for anyone that knows me. From time to time, I see interesting VMware KB articles that contain what I think are valuable tidbits of "Operational" information that could come handy in the future. I normally would bookmark these in my browser since you never know when you might need it. I figured for customers who are currently using the VCSA, having some of these operational tidbits would definitely be helpful, especially during troubleshooting or helping them build out a list of resources they could reference when they need to update, increase capacity or change the configurations for the VCSA. Instead of just keeping this list for myself, I thought I can share what I have for the latest VCSA 5.5.x as well comb through our VMware KB site looking for other handy operational KB's to include.

I have categorized the VCSA KB's into four categories that I felt made the most sense, I am sure you could break it down further but I thought this would make it easier to process. In addition, I have also included articles from virtuallyGhetto (subset from this page) that may also apply to these areas which I have listed at the very bottom in case you were interested in those as well. Hopefully this will be helpful for anyone managing VCSA(s) and if there are any that I have missed or you would like to see get added, feel free to leave a comment.

Deployment:
  • Minimum Requirements for the VMware vCenter Server 5.x Appliance (2005086)
  • Downloading and deploying the vCenter Server Appliance 5.x (2007619)
Configurations:
  • Updating VMware vCenter Server Appliance 5.x (2031331)
  • Increase the disk space in vCenter Server Appliance (2056764)
  • vCenter Server Appliance fails to reconfigure JVM settings when the memory size of the virtual machine on which it resides is modified (2066099)
  • Configuring Certificate Authority (CA) signed certificates for vCenter Server Appliance 5.5 (2057223)
  • Re-repointing and re-registering VMware vCenter Server Appliance 5.5 and components (2094888)
  • vSphere Flash Read Cache considerations for vCenter Server 5.5u2 (2072392)
  • Adding an Integrated Active Directory (IWA) Identity Source without the vSphere Web Client for vCenter Single Sign-On 5.5 (2063424)
  • Adding Default Identity Provider (2070433)
Logging & Troubleshooting:
  • Location of vCenter Server log files (1021804)
  • Location of vCenter Server Service log files (2056632)
  • Location of vSphere Profile-Driven Storage log files (2056646)
  • Location of vSphere ESXi Dump Collector log files (2003277)
  • Location of vCenter Inventory Service log files (2056632)
  • Location of vSphere Web Client service log files (2004090)
  • Location of vCenter Single Sign-On log files for vCenter Server 5.x (2033430)
  • Location of vCenter Server SMTP mail log files (2075375)
  • Enable debug logging for the vCenter Inventory Service (2021705)
  • Stopping, starting, or restarting vCenter Server Appliance services (2054085)
Backups & Recovery: 
  • Backing up and restoring the vCenter Server Appliance vPostgres Database (2034505)
  • Backing up and restoring the VMware vCenter Single Sign-On 5.5 configuration (2057353)
  • Backing up and restoring the vCenter Server Appliance Inventory Service Database (2062682)
  • Preserving the Storage Policies during a backup and restore of the vCenter Server Inventory Service Database (2072307)

virtuallyGhetto VCSA Operational Resources

Deployment:
  • Automating VCSA 5.5 Configurations including SSO Administrator password
  • How to finally inject OVF properties into VCSA when deploying directly onto ESXi?
  • Quick Tip – Automate the enabling of the Customer Experience Improvement Program (vTelemetry) in VCSA
  • How to automate NTP configurations on the VCSA using the CLI
  • Quick Tip – Minimum amount of memory to run the vCenter Server Appliance
  • Automating VCSA Network Configurations For Greenfield Deployments
Configurations:
  • Hybrid environment leveraging SSO Multi-Master Replication between vCenter Server for Windows & VCSA
  • Administrator password expiration in new VCSA 5.5
  • Automating SSL Self Signed Certificate Regeneration in VCSA 5.1 & 5.5 (vCenter Server Appliance)
  • Separating Out the vCenter SSO, vSphere Web Client and vCenter Server Services Using the VCSA
  • Changing VCSA Failed Login Attempt & Lock Out Period
  • Default Password for vCenter SSO Admin Account on VCSA
  • Automatically Join Multiple VCSA 5.1 using New vCenter SSO (Single Sign-On)
  • How to Register a vCenter Server 5.0 with Admin Tool on VCSA 5.1 Using SSH Port Forwarding
  • Automating Active Directory Identity Source & Default Domain in vSphere Web Client
  • Quick Tip – Automate JVM Heap configurations after increasing VCSA memory
  • How to change the default HTML5 VM console port in vSphere 5.5?
Logging & Troubleshooting:
  • Quick Tip – Start & Stop order for vCenter Server Services
  • Quick Tip – How to quickly find the release & build number on VCSA
  • How do I find my SSO Server 5.5 Site name?
  • Forwarding vCenter Server Logs to a Syslog Server
  • How To Add A Tag (Log prefix) To Syslog Entries
Backups & Recovery:
  • How to recover VCSA 5.5 from an expired administrator account?
Tips/Tricks:
  • How to Send vCenter Alarm Notification to Growl
  • Getting Rid of the Inventory Tree in the New vSphere Web Client
  • vCloud Director Simulator
  • How to bootstrap Horizon View 5.3.1 onto a VSAN Datastore using VCT

Categories // VCSA, vSphere Tags // inventory service, operational, sso, vcenter server appliance, VCSA, vcva

Dude, Where's My vCenter Server 5.1 Components Installed At?

04.03.2013 by William Lam // 5 Comments

You would be surprised at the number of times I have heard this question get asked and this is not regarding the installation path but the specific server a given vCenter Server 5.1 component is installed on. I am just wondering if people are somehow miss-placing their infrastructure? I would hope that most organizations have some type of CMDB (Configuration Management Database) even if it is just a spreadsheet or at a minimum a memorable hostname. In any case, this question is only relevant for those of you who decided to separate out the vCenter SSO (Single Sign-On) Server, vSphere Web Client, Inventory Service and the vCenter Server and are now wondering where a given component is installed at.
To begin, you will need to know at a minimum where your vCenter Server is installed at. If you do not know that, then you should take the walk of shame and install this utility (be-careful with port scanning tools, as it may not be allowed by your Security Operations team). Go to the advanced settings of your vCenter Server and look up one of the following settings:
  • config.vpxd.sso.sts.uri
  • config.vpxd.sso.groupcheck.uri
  • config.vpxd.sso.admin.uri

All three of these settings should contain the same hostname or IP Address which is the location of where your SSO Server is installed. You can also find this information by looking at the vCenter Server configuration file located in the following location:

Windows vCenter Server: C:\ProgramData\VMware\VMware VirtualCenter\vpxd.cfg
vCenter Server Appliance: /etc/vmware-vpx/vpxd.cfg

Next, you will need to login directly to your vCenter Server (RDP or SSH) depending on the version you are using. Using the hostname or IP Address of our vCenter SSO Server, we will now connect to the Lookup Service which is installed alongside the vCenter SSO Server. This service will provide us with the location of all services registered to vCenter SSO and we will be able to identify the location of the remainder vCenter Server components.

For Windows vCenter Server, make sure you have the JAVA_HOME environmental variable set to C:\Program Files\VMware\Infrastructure\jre and open up a command prompt and run the following (subsitute in the hostname or IP Address of your vCenter SSO Server):

vSphere 5.5

"C:\Program Files\VMware\Infrastructure\VMware\CIS\vmware-sso\ssolscli.cmd" listServices https://winvc.primp-industries.com:7444/lookupservice/sdk

vSphere 5.1

"C:\Program Files\VMware\Infrastructure\SSOServer\ssolscli\ssolscli.cmd" listServices https://winvc.primp-industries.com:7444/lookupservice/sdk

We can take a look at the serviceName which describes the specific vCenter Server component such as the vSphere Web Client or Log Browser and endpoints property will tell you which server it is installed on.

For vCenter Server Appliance, there is a similar command by running the following:

/usr/lib/vmware-sso/bin/vi_regtool listServices https://172.30.0.186:7444/lookupservice/sdk

The only vCenter Server component that we have not found is the Inventory Service. To find the server where this component is installed, we just need to look at the vCenter Server Extensions and and we can simply open up a web browser and connect to the following URL (substitute in your vCenter Server address):

https://vcsa.primp-industries.com/mob/?moid=ExtensionManager&doPath=extensionList[%22com.vmware.vim.inventoryservice%22].healthInfo

Hopefully at this point you are able to figure out where all your vCenter Server 5.1 components are installed at and you are also documenting all this information in your CMDB or spreadsheet 🙂

Categories // Automation, vSphere 5.5 Tags // inventory service, lookupservice, sso, VCSA, vcva, vSphere 5.1, vSphere 5.5, vsphere web client

Seperating Out the vCenter SSO, vSphere Web Client and vCenter Server Services Using the VCSA

12.17.2012 by William Lam // 12 Comments

The VCSA 5.1 (vCenter Server Appliance) is provided as single virtual appliance that is pre-installed with all the components needed to run a vCenter Server. These components include vCenter SSO (Single Sign-on), Lookup Service, Inventory Service, vSphere Web Client and the vCenter Server itself. In the Windows installer for vCenter Server 5.1, there is an option to install each individual component on a separate machine. How would you go about doing that for the VCSA as all the components are installed on a single machine?

The answer is actually quite simple, you just need to deploy additional VCSA systems and enable the specific component service on each of the VCSA's. I have already written articles covering some of these use cases such as deploying additional vCenter Servers leveraging a common vCenter SSO Server as well as deploying additional vSphere Web Client Servers. The one particular use case that I have not covered is running just the vCenter SSO Server on the VCSA and with this configuration, there is a minor tweak that is required to get things working correctly.Disclaimer: This may not be officially supported by VMware, please use at your own risk.

If you have attempted to configure the VCSA to run just the vCenter SSO service, then you may have seen the following error message "Could not connect to one or more vCenter Server systems" when logging into the vSphere Web Client.

The reason you are seeing this error is due to an invalid configuration found in the vCenter SSO Server and specifically with something called the Lookup Service. The Lookup Service is installed with the vCenter SSO service which can be thought of as a DNS lookup for vSphere components so they can securely find and communicate with each other. Since each VCSA component is registered with the Lookup Service as part of their initial installation and when you only enable the vCenter SSO service, the remainder services will become invalid as they are not running on the same VCSA system.

Un-Registering Services from Lookup Service:

To fix this problem, we just need to identify the services that should not be registered to the Lookup Service in the vCenter SSO Server and unregister them. To view the list of registered services to a particular Lookup Service endpoint, you can use the /usr/lib/vmware-sso/bin/vi_regtool utility with the listServices option found on the VCSA.
To use the utility, you will need to specify either the IP Address and/or Hostname of the vCenter SSO Server which runs the Lookup Service. Here is an example:

/usr/lib/vmware-sso/bin/vi_regtool listServices https://172.30.0.186:7444/lookupservice/sdk

If the command is successful, you should see a list of service endpoints such as the following:

Service 1
-----------
serviceId=local:7
serviceName=vsphere-client-localhost.localdom-eed72307-2dd2-4069-9650-e78a60b549c7
type=urn:com.vmware.vsphere.client
endpoints={[url=https://172.30.0.185:9443/vsphere-client,protocol=vmomi]}
version=5.1
description=vSphere Web Client at 172.30.0.185
ownerId=vsphere-client-localhost.localdom-eed72307-2dd2-4069-9650-e78a60b549c7@System-Domain
productId=
viSite=local

A default VCSA installation contains the following 6 services:

  • vSphere Web Client
  • Security Token Service
  • VMware Log Browser
  • SSO Group Check Service
  • vpxd (vCenter Server)
  • SSO Administration Service

We will need to identify the serviceId which starts with local:# and unregister the vSphere Web Client, VMware Log Browser and the vpxd service which is not running locally on our vCenter SSO Server. To unregister a service, you will need to create a temporarily file which contains the serviceId and use the unregisterService option with the vi_regtool.

Note: Please make sure you identify the correct serviceId before unregistering, else you may potentially run into issues with your VCSA.

Let's say we want to unregister the service that we showed earlier local:7, we would need to run the following two commands:

echo "local:7" > /tmp/serviceid
/usr/lib/vmware-sso/bin/vi_regtool unregisterService -d https://172.30.0.185:7444/lookupservice/sdk -u root -p vmware -si /tmp/serviceid

The first command will "echo" the serviceId into a temporarily file called /tmp/serviceid and the second command will perform the actual un-registration and you will need to specify the root credentials. You will need to repeat this for the other two services and once you have finished un-registering the three services, you can now log back into the vSphere Web Client and the error message should go away (a service restart is not necessary).

Now that you have some background on how to run a standalone vCenter SSO on the VCSA and the minor tweak that is required, how do we go about automating all of this during deployment? For those of you who know me, know that I would not leave my readers hanging without some scripts to assist with this manual work.

Automating Deployment of vCenter SSO, vSphere Web Client & vCenter Server Component:

The following section will describe how to completely automate the deployment of 3 separate VCSA running vCenter SSO + Lookup Service, vSphere Web Client and vCenter Server + Inventory Service as seen in the diagram above.

Step 1 - Deploy 3 VCSA 5.1 and configure basic network connectivity. In my example, I have the following setup:

Component Hostname IP Address
vCenter SSO + LS sso.primp-industries.com 172.30.0.185
vSphere Web Client webclient.primp-industries.com 172.30.0.186
vCenter Server + IS vcenter.primp-industries.com 172.30.0.187

Step 2 - Configure the vCenter SSO by creating the following shell script called configureVCSASSOStandalone.sh

#!/bin/bash

# User configurations

SSO_IP_ADDRESS=172.30.0.186

## DO NOT EDIT BEYOND HERE ##

echo "Configuring SSO..."
/usr/sbin/vpxd_servicecfg sso write embedded

echo "Starting SSO ..."
/etc/init.d/vmware-sso start

echo "Retrieving services registered with Lookupservice and storing in /tmp/ls-services ..."
/usr/lib/vmware-sso/bin/vi_regtool listServices https://${SSO_IP_ADDRESS}:7444/lookupservice/sdk > /tmp/ls-services

VC_SERVICE_ID=$(cat /tmp/ls-services | grep -B3 "type=urn:vc" | awk -F 'serviceId=' '{print $2}' | sed '/^$/d')
WEBCLIENT_SERVICE_ID=$(cat /tmp/ls-services | grep -B3 "type=urn:logbrowser:logbrowser" | awk -F 'serviceId=' '{print $2}' | sed '/^$/d')
LOGBROWSER_SERVICE_ID=$(cat /tmp/ls-services | grep -B3 "type=urn:com.vmware.vsphere.client" | awk -F 'serviceId=' '{print $2}' | sed '/^$/d')

echo "Extracting vCenter Server serviceId: ${VC_SERVICE_ID} ..."
echo "Extracting vSphere Web Client seviceId: ${WEBCLIENT_SERVICE_ID} ..."
echo "Extracting vSphere Log Browser serviceId: ${LOGBROWSER_SERVICE_ID} ..."

echo "Unregistering the local \"vCenter Server\" service from the Lookupservice ..."
echo "${VC_SERVICE_ID}" > /tmp/serviceId
/usr/lib/vmware-sso/bin/vi_regtool unregisterService -d https://${SSO_IP_ADDRESS}:7444/lookupservice/sdk -u root -p vmware -si /tmp/serviceId

echo "Unregistering the local \"vSphere Web Client\" service from the Lookupservice ..."
echo "${WEBCLIENT_SERVICE_ID}" > /tmp/serviceId
/usr/lib/vmware-sso/bin/vi_regtool unregisterService -d https://${SSO_IP_ADDRESS}:7444/lookupservice/sdk -u root -p vmware -si /tmp/serviceId

echo "Unregistering the local \"vSphere Log Browser\" service from the Lookupservice ..."
echo "${LOGBROWSER_SERVICE_ID}" > /tmp/serviceId
/usr/lib/vmware-sso/bin/vi_regtool unregisterService -d https://${SSO_IP_ADDRESS}:7444/lookupservice/sdk -u root -p vmware -si /tmp/serviceId

The only user configuration that is required is to update the SSO_IP_ADDRESS variable in the script to the IP Address of the vCenter SSO Server. You can execute the script via SSH without having to copy the script to the VCSA system, here is an example execution:

We can see from the screenshot above, we automatically look for the 3 services mentioned earlier and unregister it from the vCenter SSO Server running the Lookup Service. You can easily confirm this by re-running the listServices operation with the vi_regtool.

Step 3 - Configure the vSphere Web Client Server and you can use the configureVCSAvSphereWebClientStandalone.sh script noted in this article. The only user configuration that is required is to update the VCENTER_SSO_IPADDRESS variable in the script to point to the IP Address of your vCenter SSO Server. Here is an example execution:

Step 4 - Finally, the last step is to configure the vCenter Server and you can use the configureVCSAExtra.sh script noted in this article. The only user configuration that is required is to update the PRIMARY_VC variable in the script to point to the IP Address of your vCenter SSO Server. Here is an example execution:

Once the vCenter Server has successfully started, then you are now done with seperating out the three components of the vCenter Server using the VCSA. You can confirm additionally by logging back into the vCenter SSO Server and run the listServices and you should now see the IP Address or Hostname of your vSphere Web Client Server and vCenter Server being registered to the Lookup Service from the separate VCSA's. You can now login to the vSphere Web Client server and make sure you specify the full URL which should be https://[hostname-or-ipaddress]:9443/vsphere-client and you should be able to see your vCenter Server.

Note: Steps 3 and 4 can be interchange as the order does not matter, as long as vCenter SSO system is setup first.

Categories // vSphere Web Client Tags // inventory service, sso, VCSA, vcva, vsphere web client

Search

Thank Author

Author

William is Distinguished Platform Engineering Architect in the VMware Cloud Foundation (VCF) Division at Broadcom. His primary focus is helping customers and partners build, run and operate a modern Private Cloud using the VMware Cloud Foundation (VCF) platform.

Connect

  • Bluesky
  • Email
  • GitHub
  • LinkedIn
  • Mastodon
  • Reddit
  • RSS
  • Twitter
  • Vimeo

Recent

  • Programmatically accessing the Broadcom Compatibility Guide (BCG) 05/06/2025
  • Quick Tip - Validating Broadcom Download Token  05/01/2025
  • Supported chipsets for the USB Network Native Driver for ESXi Fling 04/23/2025
  • vCenter Identity Federation with Authelia 04/16/2025
  • vCenter Server Identity Federation with Kanidm 04/10/2025

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2025