The vMA authentication component allows you to authenticate with target hosts using vi-fastpass or Active Directory. When adding a server as a target, you can configure which authentication method to use. If you use vi-fastpass authentication, the credentials that you have for vCenter Server or ESXi are stored in a local credential store. If you use Active Directory authentication, no credentials are stored locally, but the user authenticates with an Active Directory server.

When using vi-fastpass with an ESXi host, two accounts with encrypted passwords are created on the ESXi host. The account vi-admin is created with administrator rights, whereas the vi-user account is created on ESXi with read-only privileges. That password information is stored locally in a credential store. To enable a number of vMA appliances to manage the same ESXi host, each vMA appliance creates the accounts in the format of vi-admin<XX> and with a unique login name, as shown in Figure 8.3.

Figure 8.3. Each vMA appliance creates a unique instance of vi-admin and vi-user on an ESXi host.

If Active Directory is used to connect to the target host, the accounts are not created and no credentials are stored. It is necessary to set up the vMA to join the Active Directory (AD) domain.

Once you have configured your target hosts, you can issue the vifptarget command to start an authenticated session with the host. Subsequent vCLI commands that you run do not require the --server option or any authentication options.

sudo rm /etc/localtime
sudo ln -s /usr/share/zoneinfo/America/Vancouver /etc/localtime

vifp addserver vcenter.mishchenko.net --authpolicy adauth
      --username 'MISHCHENKOdave.mishchenko'
vifp addserver esx01.mishchenko.net --authpolicy adauth
      --username 'MISHCHENKOdave.mishchenko'

vifp listservers --long
vcenter.mishchenko.net   vCenter adauth
esx01.mishchenko.net     ESXi    adauth

vifptarget --set esx01.mishchenko.net
vicfg-nics -l
vifptarget -s vcenter.mishchenko.net
vicfg-nics --vihost esx02.mishchenko.net -l

vifp addserver vcenter.mishchenko.net --authpolicy fpauth
      --username 'MISHCHENKOdave.mishchenko'
[email protected]'s password:
This will store username and password in credential store which is a security risk.
Do you want to continue?(yes/no): yes
vifp addserver esx01.mishchenko.net --authpolicy fpauth
      --username 'MISHCHENKOdave.mishchenko'
[email protected]'s password:

vifp listservers --long
vcenter.mishchenko.net    vCenter fpauth
esx01.mishchenko.net      ESXi    fpauth

vifptarget --set esx01.mishchenko.net
vicfg-nics -l
vifptarget -s vcenter.mishchenko.net
vicfg-nics --vihost esx02.mishchenko.net -l

vifp reconfigure esx01.mishchenko.net --authpolicy adauth

vifp reconfigure esx01.mishchenko.net

With the vi-logger component, you can capture log files from vCenter Server and ESXi. Use of vi-logger is suitable for small and medium-sized environments, but for large environments, you should consider using an enterprise-scale log collection tool rather than vi-logger. From vCenter Server, you can gather the vpxd.log file, which contains logging data for the vCenter Server Windows service. For ESXi, you can capture the following log files:

The heart of the vi-logger component is the vilogd daemon, which is responsible for log collection. The daemon is set to start automatically each time the vMA virtual machine is started. When you are logged in with the vi-admin account, you can control and check the start of the vilogd daemon. To check the status of the service, run the following command:

/sbin/service vmware-vilogd status
vmware-vilogd is running

To restart the daemon, you can issue this command:

sudo /sbin/service vmware-vilogd restart
Stopping vmware-vilogd:                   [ OK ]
Starting vmware-vilogd:                   [ OK ]

To configure hosts for log collection, you use the command vilogger. Prior to adding a host, you must configure it as a vMA target, as shown in the previous section. When you want to start capturing data, you first need to enable logging for some or all of your vMA targets. To accomplish this, you run vilogger enable, and you can include the options in Table 8.3 to customize the logging configuration. If you run vilogger enable with no options, all your vMA targets are enabled for logging with the default values for the options in Table 8.3.

You can use any combination of options to customize the logging level for each host. In the following example, the first command gathers all log files on an ESXi host and collects data every 60 seconds. The second command collects the vpxd.log file from vCenter Server and retains 100MB worth of logged data, using 10 log files.

vilogger enable --server esx01.mishchenko.net --collectionperiod 60

Target Server: esx01.mishchenko.net
hostd       ... Enabled
messages    ... Enabled
vpxa        ... Enabled

vilogger enable --server vcenter.mishchenko.net --numrotation 10 --maxfilesize 10

Target Server:  vcenter.mishchenko.net
vpxd        ... Enabled

To review the logs being collected by the vilogd daemon, you can issue the command vilogger list. You can optionally include --server or --logname to filter the output. The output of vilogger list is shown in Figure 8.4.

Figure 8.4. Displaying the vilogger configuration with vilogger list.

sudo rm /etc/localtime
sudo ln -s /usr/share/zoneinfo/UTC /etc/localtime
sudo reboot

To update log collection for a vMA target, you can use vilogger updatepolicy. This command uses the options shown in Table 8.3. To update the logging configuration for the ESXi host used in the preceding example, you would issue the following command:

vilogger updatepolicy --server esx01.mischenko.net --collectionperiod 30

With this command, all logs being gathered for the ESXi host would now be collected every 30 seconds. If you need to disable logging, you can use vilogger disable. This command takes the options of --server, --logname, and --force. The --force option should be used when the vMA target is unreachable; otherwise, the vilogger disable command fails. In the first example, logging of the message’s log file for an ESXi host is disabled; in the second example, all logging for an ESXi host is disabled; and in the last example, all logging on the vMA appliance is disabled.

vilogger disable --server esx01.mishchenko.net --logname messages
vilogger disable --server esx01.mishchenko.net
vilogger disable

The host-related commands can perform a number of management and configuration tasks on your ESXi hosts. You have already seen examples of a number of these commands used in previous chapters, such as vicfg-authconfig for enabling AD integration, vicfg-ipsec for configuring IPsec, and vicfg-ntp for enabling NTP synchronization. In the following section, you learn about the other host-related vCLI commands.

One of the new vCLI commands in vSphere 4.1 is vicfg-hostops. To shut down a host, you can issue the following command:

vicfg-hostops --operation shutdown --force.

With the --force option, the command shuts down all running virtual machines and then the host. You can omit this option if you’ve put the host into Maintenance Mode. With this command, you can also use the --cluster or --datacenter options to shut down entire clusters or datacenters as required.

You can also use the reboot option, which works in the same manner as shutdown and accepts the same options. Prior to issuing a reboot or shutdown command, a host should be placed in Maintenance Mode. For a host that is a member of a Distributed Resource Scheduler (DRS) cluster, the virtual machines running on the host migrate to other hosts before the server can enter Maintenance Mode. If the host is not a member of a DRS cluster, vicfg-hostops suspends any running virtual machines. A host remains in Maintenance Mode until you take it out of Maintenance Mode, and no virtual machines can be started on a host in Maintenance Mode. Run the following command to place a host into Maintenance Mode:

vicfg-hostops --operation enter

You can also use the --cluster or --datacenter options with this operation. To take a host out of Maintenance Mode, you can substitute the option exit. When you put a host in Maintenance Mode, you can get the status of that operation with the info option. This option also displays information about the host’s central processing unit (CPU), memory, whether vMotion is enabled, and the last boot time. An example of the output for the info option follows:

vicfg-hostops --operation info

Host Name           : esx01.mishchenko.net
Manufacturer        : Supermicro
Model               : X8DTL
Processor Type      : Intel(R) Xeon(R) CPU E5520 @ 2.27GHz
CPU Cores           : 4 CPUs x 2266 GHz
Memory Capacity     : 8182.8359375 MB
vMotion Enabled     : yes
In Maintenance Mode : yes
Last Boot Time      : 2010-07-27T06:10:48.791755Z

Each of your ESXi hosts should be configured with a dump partition. The command vicfgdumppart is used to display the configuration of the dump partition and to make changes to it. The dump partition is used to store core dumps should your host fail and display a purple screen. You can modify the dump partition to be located on a Fibre Channel or iSCSI LUN, but the iSCSI LUN should be accessible via a hardware iSCSI adapter.

To display the current configuration, issue the following command:

vicfg-dumppart --get-active

To display the potential targets, you can use the --find option. The active dump partition is shown as well as all potential partitions. The output may display partitions accessible via the ESXi software iSCSI adapter, but these should not be used for the dump partition. To change the dump partition, you first run vicfg-dumppart with the --deactivate option. Then use the --set option and specify one of the available partitions to set and activate the new dump partition.

From time to time, you may find that you have to set advanced configuration options on your ESXi host. This can be accomplished with the vSphere client, as shown in Figure 8.5. You may be instructed by VMware support to make such a change or you may be following a Knowledge Base article.

Figure 8.5. Adjusting advanced configuration settings with the vSphere client.

These configuration changes can also be made with the command vicfg-advcfg. The following commands are used to increase the number of Network File System (NFS) mounts that an ESXi host can support:

vicfg-advcfg -s 32 NFS.MaxVolumes
Value of MaxVolumes is 32

vicfg-advcfg -s 120 Net.TcpipHeapMax
Value of TcpipHeapMax is 120

mcli <file containing ESXi server list> vicfg-advcfg -s 32 NFS.MaxVolumes

The vicfg-module command is used to set and retrieve VMkernel module options. The --list and --query options display the modules that the VMkernel has loaded. You can change options for a module with the --set-option option. The following example changes the queue depth for all Emulex Fibre Channel adapters using the specified module:

esxcfg-module --set-option 'lpfc_lun_queue_depth=20' lpfc820.o

After you have set an option, you can use the following command to query the module to verify the change:

esxcfg-module --get-option lpfc820.o

The final command for managing your host that this section discusses is vicfg-user. This command is used to manage accounts and groups that are locally defined on your ESXi host. With this command, you can assign users and groups to a role, but you cannot create or manage roles with it. Table 8.5 lists the command’s options. The command is always issued with the following format:

vifcg-user --entity <user | group> --operation <add | modify | delete | list>

To create a user, you can use the following command:

vicfg-user --entity user --operation add --login user1 --newpassword Secret45

The command does not include the --role option, so this new login does not have access to the ESXi host. To verify that the user was created, you can change the operation to list to view all users defined on the host:

vicfg-user --entity user --operation list

To change the role for an existing user, change the operation to modify, as the following example shows:

vicfg-user --entity user --operation modify --login user1 --role admin

The vicfg-user command script is coded to accept only admin, read-only, and no-access as valid roles even if you have defined other roles on the host. If you are interested in learning more about scripting with the vSphere SDK for Perl, you can start by modifying an existing script such as vicfg-user to meet your needs.

To manage groups with vicfg-user, you change the --entity option to group. If you require a number of local users on your ESXi hosts with the same permissions, it is easier to create a group, assign permissions to the group, and then to add users to the group. To create a new group and assign a role to it, issue the following command. You can optionally add the --groupid parameter to assign a group ID to the new group.

vicfg-user --entity group --operation add --group ESXiAdmins --role admin

To add a user to that group, you can issue the following command:

vicfg-user --entity group --operation modify --group ESXiAdmins --adduser admin1

To add a number of users to the group in one command, you list the users separated by a comma:

vicfg-user --entity group --operation modify --group ESXiAdmins
      --adduser admin1, admin2, admin3

Although such use is not documented as being officially supported, you can use vicfg-user to manage AD users if the host has been enabled for AD integration. You cannot create an AD user or group on your ESXi, but you can assign a role to the account or group.

vicfg-user --entity user --operation modify -login 'MISHCHENKOdave.mishchenko'
      --role admin
Updated user MISHCHENKOdave.mishchenko successfully.
Assigned the role admin
vicfg-user --entity user --operation delete -login 'MISHCHENKOdave.mishchenko'
Removed the user MISHCHENKOdave.mishchenko successfully.

vicfg-user --entity group --operation modify --group 'MISHCHENKODomain Admins'
      --role admin
Assigned the role admin
Vicfg-user --entity group --operation delete --group 'MISHCHENKOdomain^admins'
Deleted MISHCHENKOdomain^admins successfully.

Note that although the commands to add an AD user or group are not case-sensitive for the username or group name, it is case-sensitive when the commands are deleting the user or group. When adding a user or group with a space in the name, ESXi replaces the space with the ^ character. When you delete the user or group, you must include this as shown in the removal of the domain admins group in the preceding example.

The vCLI includes a version of vmware-cmd, svmotion, which allows you to migrate virtual machines, and the esxcli command has been improved to allow the forcible termination of virtual machines. The vmware-cmd enables the following virtual machine functions:

When using vmware-cmd, you follow this syntax for entering commands:

vmware-cmd <virtual machine config file> <operation> <operation options>

To view a list of virtual machines registered on your ESXi host, you run the following command. The output lists the full path to the virtual machines configuration file, including the datastore UUID rather than the datastores logical name.

vmware-cmd -l
/vmfs/volumes/4a7cf921-017eb919-bb32-000423e540c6/SQL04/SQL04.vmx

When entering vmware-cmd commands that require the virtual machine’s configuration file, you can enter the full path as shown in the preceding example. Alternatively, you can use the data-store logical name in either of the following formats. If you are using the first method shown, you need to enclose the path in quotes appropriate to the OS that you are running the vCLI on.

[datastore1] SQL04/SQL04.vmx
/vmfs/volumes/datastore1/SQL04/SQL04.vmx

To register a virtual machine, you can use the -s option, as shown in this example:

vmware-cmd -s register vmfs/volumes/datastore1/SQL04/SQL04.vmx

For vmware-cmd commands, a 1 is returned for a successful operation and a 0 for a failure.

You can use vmware-cmd to obtain information about the virtual machine and the host that it is running on. Table 8.6 summarizes the operations that are available.

To start the virtual machine, you can use the following command. To stop the virtual machine, you change the operation to stop, but you also must specify an operation option of soft or hard. For the soft option, ESXi attempts to perform a clean shutdown of the guest OS via VMware Tools. With the hard option, ESXi simply powers down the virtual machine. The other power operations are suspend and reset.

vmware-cmd /vmfs/volumes/datastore1/SQL04/SQL04.vmx start

In some cases, you may find that you cannot power down a virtual machine or reset it. On ESX, you may have followed a process of accessing the Service Console, using the ps command to find the process ID for the virtual machine and then issuing a kill command on that process ID. With ESXi and the vCLI, you can use esxcli to accomplish the same process. esxcli is a new interface for vSphere that provides modular access to various components called namespaces. esxcli accesses an unpublished API to perform high-level configuration, such as iSCSI configuration and storage multipathing, and management of various components, such as core storage commands.

To use esxcli to kill an unresponsive virtual machine, you first need to determine the World ID. Run the following command to return a list of running virtual machines on the host:

esxcli vms vm list
SQL04
  World ID: 9577
  Process ID: 0
  VMX Cartel ID: 9576
  UUID: 56 4d 2e 83 2f 38 ff 7f-ff f8 62 58 03 86 2b a0
  Display Name: SQL04
  Config File: /vmfs/volumes/4a7cf921-017eb919-bb32-0423e540c6/SQL04/SQL04.vmx

After you have the World ID, you can issue the kill command:

esxcli --server esx01 vms vm kill --type hard --world-id 9577
true

The kill command requires the option --type to specify the nature of the kill operation to perform. The following three options are available and should be executed in sequential order:

The svmotion command allows you to move a virtual machine’s configuration file and optionally its virtual disks to another datastore while the virtual machine is running. You can choose a single location for the configuration file and virtual disks or choose separate locations for each. You can’t change the host that the virtual machine is running on with svmotion.

The svmotion command can be run in one of two modes. In Noninteractive Mode, you specify the new location for the configuration file and optionally new locations for one or more of the virtual disks:

svmotion --datacenter=<datacenter name>
   --vm <virtual machine configuration datastore path>:<new datastore>
   [--disks <virtual disk datastore path>:<new datastore>,
   <virtual disk datastore path>:<new datastore>]

With Interactive Mode, you add the --interactive option, in which case all other options are ignored. In this mode, the script prompts you for each required parameter. The parameters that you enter are validated as you enter them; because of this, you cannot, for example, enter a datastore name that does not exist. This option can be useful for troubleshooting if you are having problems with Noninteractive Mode. For either mode, you should ensure that you enclose parameters in quotes if they contain special characters.

With the vCLI networking commands, you can manage the configuration of your host’s networking services. The vCLI includes the following four commands for networking: vicfgnics, vicfg-vswitch, vicfg-vmknic, and vicfg-route.

To manage the physical NICs in your host, you use the command vicfg-nics. The --list option provides a list of the NIC ports that are visible to your host, as shown in Figure 8.6. You may need to obtain this information before you can begin to create vSwitches.

Figure 8.6. A list of physical NIC ports generated by vicfg-nics.

Should you need to configure the speed or duplex settings for a NIC, you can use the --speed and --duplex options. To set the speed and duplex for the vmnic0 of the host, you would issue the following command:

vicfg-nics --duplex full --speed 1000 vmnic0

A NIC can be set to auto negotiation with this command:

vicfg-nics --auto vmnic0

The vicfg-vswitch command is used to manage both standard vSwitch and Distributed Virtual Switches (dvSwitch). With dvSwitches you must create a dvSwitch and then add hosts to it with the vSphere client when connected to vCenter Server. You can then manage ports and properties with vicfg-vswitch.

To create a new vSwitch, you can issue the following command. No output is displayed unless there is an error.

vicfg-vswitch --add vSwitch1

To create a port group on that vSwitch, you issue the following command:

vicfg-vswitch --add-pg iSCSI1 vSwitch1

vicfg-vswitch --check vSwitch1
1
vicfg-vswitch --check-pg PortGroup1 vSwitch1
0

To link a vSwitch to a physical network port, you can use the command that follows. You can also link a NIC port to a specific port group.

vicfg-vswitch --link vmnic2 vSwitch1
Updated uplinks: vmnic2

Should you require the setup of virtual local area networks (VLANs) on your port groups, use the --vlan option. You can configure a specific VLAN, use 0 to disable the VLAN for a port group, or use 4095 to allow VLAN tags set by the guest OS to pass through the vSwitch unchanged. The following example sets the VLAN to 100 for the port group created earlier:

vicfg-vswitch --vlan 100 -pg PortGroup1 vSwitch1

Once you have configured your vSwitch, you can review the settings with the --list option. If you want to enable jumbo frames, you may also change the maximum transmission unit (MTU) for the vSwitch with the --mtu option. If you’re using Cisco switches, you can enable the Cisco Discovery Procotol with --set-cdp.

To configure VMkernel networking, you use the vicfg-vmknic command. With ESXi, you have no Service Console ports, but rather you create a VMkernel port for management traffic, vMotion traffic, and IP storage. If you’re configuring iSCSI storage, you can first create a VMkernel port and then bind it for iSCSI usage with esxcli, as you can see in the next section, “Managing Host Storage.”

To add a new VMkernel port, you supply an IP address, subnet mask, and name, as in the following example. The name should be an existing port group that you’ve created with vicfgvswitch.

vicfg-vmknic --add --ip 192.168.1.105 -n 255.255.255.0 iSCSI1
Added the VMkernel NIC successfully

To change the IP address for a VMkernel port, you can issue the following command. You can either specify an IP address or DHCP if you plan to use that.

vicfg-vmknic --ip 192.168.1.110 iSCSI1

Some of the other options for the command include --enable-vmotion, --mtu to set the MTU, and --tso to disable Transmission Control Protocol (TCP) Segmentation Offload (TSO) for the VMkernel port. If you plan to use IPv6 with your VMkernel networking, you must first enable IPv6 on the VMkernel port. To enable IPv6, you can issue the following command sequence:

vicfg-vmknic --enable-ipv6 true iSCSI1
Please reboot the system now for the change to take effect.
vicfg-hostops --operation enter
Host esx10.mishchenko.net entered into maintenance mode successfully.
vicfg-hostops --operation reboot
Host esx10.mishchenko.net rebooted successfully.

After the host has rebooted, you can set an IPv6 address on a VMkernel port using the --ip option used earlier for an IPv4 address. The valid options for setting an IPv6 address are to use a static IPv6 address, DHCPv6 for a DHCP IPv6 address, and AUTOCONF to obtain an IPv6 address via router advertisement. Don’t forget to take the host out of Maintenance Mode.

To disable IPv6 on the host, you first remove the IPv6 address and then use the --enable-ipv6 option to disable it:

vicfg-vmknic --unset-ip 2001:10:20:253::20/64
vicfg-vmknic --enable-ipv6 false iSCSI1

To manage the VMkernel gateway or routing, you can use vicfg-route. If the command is run without any options, the IPv4 default gateway is shown. Use the --family v6 option to configure or display the IPv6 gateway. To set the default VMkernel gateways for IPv4 and IPv6, run the following commands:

vicfg-route --add default 192.168.1.1
vicfg-route --family v6 --add default 2001:10:20:253::1

To change the default gateway, you must first delete the existing gateway and then add the new one. Use the following command to delete the default IPv6 gateway:

vicfg-route --family v6 --delete default 2001:10:20:253::1
WARNING! Removing the default route for system!
Removing the default route may result in lost network connectivity
Are you sure you wish to proceed? (y/n) y

To add routes to your ESXi host, you can use the following commands:

vicfg-route --add 192.168.2.0/24 192.168.1.2
vicfg-route --family v6 --add 2000:10:20:254::/64 2001:10:20:253::2

One of the new namespaces added to esxcli for vSphere 4.1 is network. This namespace allows you to list information about the current IP connections and the active Address Resolution Protocol (ARP) table for the host. The first execution of esxcli network that follows uses the connection application with the list command. This displays the current connections for the host in numeric format and is the equivalent to running netstat -tuwln at the console of an ESX host. It is possible to filter the output by using the -t | --type option and specifying a type of ip, tcp, udp, or all. In the second instance of esxcli network, the neighbor application is run with the show command. This displays the active ARP table entries. You can use the option -v | --version with the switches of 4, 6, or all to filter IPv4 and IPv6 addresses.

esxcli network connection list

Proto   Recv-Q   Send-Q Local Address       Foreign Address     State        World ID
------- ------   --------- ----------       ---------------     -----------  ---------
tcp     0        492    127.0.0.1:51002     127.0.0.1:8307      ESTABLISHED  899921
tcp     0        0      192.168.1.30:443    192.168.1.27:35438  ESTABLISHED  902512
tcp     0        0      127.0.0.1:5988      127.0.0.1:63363     FIN_WAIT_2   0
tcp     0        0      127.0.0.1:63363     127.0.0.1:5988      CLOSE_WAIT   899919
tcp     0        0      127.0.0.1:5988      127.0.0.1:52581     TIME_WAIT    0
tcp     0        0      192.168.1.30:49154  192.168.1.5:389     TIME_WAIT    0
tcp     0        0      192.168.1.30:443    192.168.1.225:60225 ESTABLISHED  902510
tcp     0        0      192.168.1.30:902    192.168.1.225:60211 ESTABLISHED  0
tcp     0        0      192.168.1.30:894    192.168.1.100:2049  ESTABLISHED  0
tcp     0        0      192.168.1.30:61602  192.168.1.105:3260  ESTABLISHED  4967

esxcli network neighbor list

Neighbor                  Mac Address        vmknic  Expiry(sec)   State
--------                  -----------        ------  -----------   ------
192.168.1.1               00:04:5a:fb:a9:2d  vmk0    1169
192.168.1.5               00:10:a4:f2:30:a5  vmk0    1195
192.168.1.100             00:0e:0c:c2:ce:fb  vmk0    1014
192.168.1.105             00:0c:29:35:9e:49  vmk0    1118
192.168.1.225             00:23:54:06:f3:a6  vmk0    1178
fe80::230:48ff:fedb:6888  00:30:48:db:68:88  vmk0    0             Reachable

The vCLI contains a number of commands to manage storage devices, datastores, and files. These can be used to manage local, Fibre Channel, iSCSI, and NFS storage for your hosts.

With the support of vMotion, DRS, and High Availability on NFS volumes, NFS is increasingly becoming the choice of storage for ESXi hosts. ESXi supports NFS version 3 over TCP/IP. After you have your networking set up for access to your NFS server, you can use esxcfg-nas to configure the NFS share as a datastore. The following command is used to list any existing NFS datastores:

vicfg-nas --list
NFS1 is /NFS1 from 192.168.1.100 mounted

To add another datastore, you use the --add option as shown in this example and add the NFS server hostname or IP address, the share name, and the datastore name to use. You can add the -y option to make the mount read-only, which would be appropriate for a datastore storing ISO images:

vicfg-nas --add -y --nasserver 192.168.1.100 --share /NFS2 NFS2

The following steps use vicfg-iscsi to enable and configure the ESXi software iSCSI initiator to create a new datastore on an iSCSI server. One of the significant iSCSI improvements in vSphere is iSCSI multipathing. With ESX 3.5, the iSCSI initiator can establish only a single TCP connection to each iSCSI target. Thus iSCSI traffic is limited to a single NIC port within a vSwitch, even though the vSwitch may be linked to multiple NICs. If your environment has required greater throughput, you may have configured your iSCSI storage with multiple iSCSI targets and your hosts with a number of VMkernel ports to be able to initiate multiple iSCSI sessions to your iSCSI storage. The default behavior with vSphere is the same as with ESX 3.5 to allow for a simple upgrade from ESX 3.5. But you can enable multipathing with esxcli to enable multiple connections to the same iSCSI target.

To begin, vicfg-iscsi is used to enable the software iSCSI initiator on ESXi. The subsequent commands verify that the initiator is enabled and determine the Host Bus Adapter (HBA) ID.

vicfg-iscsi --swiscsi --enable
Enabling software iSCSI...

vicfg-iscsi --swiscsi --list
Software iSCSI is enabled.

vicfg-iscsi --adapter --list
vmhba33         iSCSI Software Adapter

You can optionally set an alias for an iSCSI HBA. The iSCSI name generated for the iSCSI HBA is similar to iqn.1998-01.com.vmware:esx10-627fb181. An alias provides a more manageable name for the device and can be changed with the following command. You can also change the iSCSI name, but you must ensure that you assign a name that is unique within your organization.

vicfg-iscsi --swiscsi --iscsiname --alias ESX10_vmhba33 vmhba33

After you have enabled the iSCSI software initiator, you can add a discovery target. The target can be dynamic or static. With dynamic discovery, all storage targets associated with a hostname or IP address are discovered. With static discovery, you specify the hostname or IP address and the iSCSI name of the storage target. The following example adds an iSCSI target with dynamic discovery:

vicfg-iscsi --server esx10 --username root --password '' --swiscsi --discovery
      --add --ip 192.168.2.105 vmhba33
Adding discovery address 192.168.2.105:3260 ...
A rescan of the host is recommended for this configuration change.

To secure access to your iSCSI targets, you may employ the Challenge-Handshake Authentication Protocol (CHAP). With CHAP authentication, both the ESXi host and iSCSI target share a common username and password. During iSCSI login, the ESXi host authenticates with the iSCSI target. You can also enable mutual authentication in which the iSCSI target is also required to authenticate with the ESXi host. When configuring CHAP authentication, one of the levels shown in Table 8.7 is required.

To enable authentication with an iSCSI target, you can issue the following command. In this case, CHAP is required and the ESXi host authenticates with the iSCSI target at 192.168.2.105 with a username of user1 and a password of pass5. This example sets CHAP authentication for a specific iSCSI target. If the -i option were excluded, CHAP authentication would be enabled for all iSCSI targets. This mimics the behavior of the vSphere client, with which you can enable CHAP settings on both the HBA and target levels.

vicfg-iscsi --authentication -c chapRequired -m CHAP -u user1 -w pass5
     -i 192.168.2.105 vmhba33

If you need to enable mutual CHAP, you should first enable CHAP before running the command that follows. The username and password used for mutual authentication do not need to match the values that you used to set up CHAP authentication. However, the CHAP level must match. Note that the command syntax is nearly identical, but it adds the -b option for mutual authentication.

vicfg-iscsi --authentication -c chapRequired -m CHAP -b -u user3 -w pass4
      -i 192.168.2.105 vmhba33

To review the authentication settings for the HBA you have configured, you can issue this command:

vicfg-iscsi --authentication --list vmhba33

Tip

If you configure Advanced Settings for your iSCSI connections using the vSphere client as shown in Figure 8.7, you can also configure those with vicfg-iscsi using the -W option.

Figure 8.7. iSCSI Advanced Settings in the vSphere client may also be set using vicfg-iscsi.

After you have completed the setup for your iSCSI connected storage, you can issue the following command to rescan for new LUNs. vicfg-rescan should be run each time you make a storage configuration change.

vicfg-rescan vmhba33
Scan operation succeeded.

You can then use vicfg-scsidevs to view the storage LUNs that have been discovered. With this command, you can display data such as the UUID, device type, display name, and multi-pathing plug-in. With that information, you can utilize vmkfstools to format the LUN as a VMFS datastore or to create a raw device mapping. With vmkfstools, you can manage data-stores, including extending datastores and virtual disks in the same manner in which you would use vmkfstools at the Service Console.

With the preceding setup, the iSCSI initiator makes a single connection to the iSCSI target. In the following example, vSwitch1 has been created for iSCSI storage and it is linked to vmnic2 and vmnic3. As the following output from resxtop shows the network traffic for the iSCSI target is passing through vmnic2 while vmnic3 is idle. resxtop is discussed later in the chapter.

 PORT-ID         USED-BY TEAM-PNIC   DNAME       PKTTX/s   MbTX/s
16777217      Management       n/a   vSwitch0       0.00     0.00
16777218          vmnic0         -   vSwitch0    1089.87     0.74
16777219            vmk0    vmnic0   vSwitch0    1089.87     0.74
33554433      Management       n/a   vSwitch1       0.00     0.00
33554434          vmnic2         -   vSwitch1     522.65   125.30
33554435          vmnic3         -   vSwitch1       0.00     0.00
33554441            vmk1    vmnic2   vSwitch1     522.65   125.30
33554442            vmk2    vmnic3   vSwitch1       0.00     0.00

With esxcli from the vCLI, you can enable iSCSI multipathing. As you have seen previously, esxcli can be used to kill a virtual machine, but it can also be used to configure and manage a wide range of storage options, including iSCSI sessions and storage path policies. It is worthwhile to review the vCLI guides provided by VMware to gain a full understanding of the power of the vCLI utility.

Before enabling multipathing, you should configure your vSwitch so that each VMkernel port is set to be active on only one of the physical NIC links. Figure 8.8 shows that the iSCSI1 VMkernel port has been set to be active on vmnic2 and not to use vmnic3. The iSCSI2 VMkernel port is set in a similar manner to be active on vmnic3 and not to use vmnic2.

Figure 8.8. Preparing your vSwitch for iSCSI multipathing.

To configure multipathing, you must first determine the VMkernel interface names for the iSCSI port groups that have been created on the vSwitch. The command to display those interface names follows. Those interface names are then used with esxcli to add the VMkernel port to the software iSCSI HBA.

vicfg-vmknic --list
Interface  Port Group/DVPort     IP Family   IP Address               Netmask
vmk0       Management Network    IPv4        192.168.1.40             255.255.255.0
vmk0       Management Network    IPv6        fe80::20c:29ff:fe3f:dab0 64
vmk1       iSCSI1                IPv4        192.168.2.115            255.255.255.0
vmk1       iSCSI1                IPv6        fe80::250:56ff:fe72:d55e 64
vmk2       iSCSI2                IPv4        192.168.2.116            255.255.255.0
vmk2       iSCSI2                IPv6        fe80::250:56ff:fe73:834  64

esxcli swiscsi nic add -n vmk1 -d vmhba33
esxcli swiscsi nic add -n vmk2 -d vmhba33

To verify your setup, you can use the list option to display the VMkernel ports that have been bound to the HBA. If the settings are correct, you can issue the rescan command to discover the new paths to your iSCSI target:

esxcli swiscsi nic list -d vmhba33
vicfg-rescan vmhba33
Scan operation succeeded.

To manage files on your ESXi host, the vCLI includes the command vifs. If you’re copying or cloning virtual disks on your datastores, vmkfstools is still the command to use. However, with vifs you can create folders, manage all file types, and copy files between your ESXi host and your management computer. This is one of the significant differences you’ll find with using the vCLI to manage your host. With the service console on ESX, you access and edit files directly. With ESXi, you need to copy those files to your management computer, edit the files locally, and then copy those files back to the host with vifs.

vifs can be used to access host files such as esx.conf, which is discussed further in Chapter 11, “Under the Hood with the ESXi Tech Support Mode.” When accessing files on a datastore, you should specify the path in either the datastore format of [datastore] path/file or with the full path, such as /vmfs/volumes/datastore/path/file. To avoid problems with special characters or spaces, ensure that you enclose the path in quotes.

To list the datastores for your ESXi host, issue the following command:

vifs --listds

To create a directory and then copy the file from your computer to your host, you would use the following commands:

vifs --mkdir '[datastore1] ISO_images'
vifs --put Linux.iso '[datastore1] ISO_images/Linux.iso'

Note that when you copy of a file to a datastore, you must specify the destination file name.

If you have an existing virtual machine and want to make a copy of it, you would follow this procedure:

resxtop is included with the vCLI to provide detailed information on how ESXi is using resources in real time. You can use the utility in one of three modes: Interactive, Batch, and Replay. Replay Mode is covered further in Chapter 11. resxtop is included with the vCLI to replace esxtop, which you execute in the Service Console for ESX. With resxtop, you can quickly determine whether a certain resource is the cause of performance problems. resxtop is not available on the Windows version of the vCLI. For more information about interpreting the statistics that resxtop records, you can consult this VMware Communities document: http://communities.vmware.com/docs/DOC-11812. The Performance community on VMware’s forums contains a number of documents on troubleshooting specific performance issues.

With vSphere 4.1 resxtop has been enhanced and includes a number of improvements, such as the addition of NFS performance statistics. It is now possible to monitor NFS storage at the datastore level for a host, and at the datastore and virtual disk levels for a virtual machine.

When you start resxtop, it begins in Interactive Mode and displays CPU statics for the ESXi host. The data is refreshed every five seconds, but you can change that setting by pressing s and then entering the new interval in seconds. Be aware that excessive sampling, especially in Batch Mode, imposes a CPU load on the host.

To change views, you can use the following keys:

You can press h to get a full list of command options. You may choose to re-sort the column order, sort the data in a specific order, or remove some columns. To save the customizations that you make, press W and you are prompted to save a configuration file, as follows:

Save config file to (Default to : /home/vi-admin/.esxtop41rc):

With Batch Mode, you can capture data for further performance analysis. The following command enables Batch Mode with the -b option. The -c option specifies the configuration file to use, -n instructs resxtop to collect 500 iterations of data, and -d sets the collection delay to five seconds. The command collects 2500 seconds of performance data and pipes the data to the file output.csv.

resxtop -b -c .esxtop41rc -n 500 -d 5 > output.csv

After you have collected the data, you can use tools such as Windows Performance Monitor, Microsoft Excel, and esxplot to analyze the data. esxplot is available at http://labs.vmware.com/flings/esxplot and runs on Linux, OSX, and Windows. Start the esxplot application, select File > Import > Dataset and select the data file generated by resxtop. Then double-click on the hostname and select a performance metric to display as shown in Figure 8.9.

Figure 8.9. Viewing performance data with esxplot.