Auditing ESXi Shell logins and commands in ESXi 5.x

To determine the commands executed in the ESXi Shell, and which user and client issued the request:

1. Obtain access to the auth.log and shell.log log files.
   
   • Log in to the ESXi Shell, and open each log using the less command.
     
   • Use a web browser to access https://ESXiHostnameOrIP/host/auth.log andhttps://ESXiHostnameOrIP/host/shell.log.
   • Use the vifs command line utility in the vCLI to copy the logs to a client, and review them there.
     
   • Read the files from within a vm-support log bundle.
     
     
2. Open the log file /var/log/auth.log in a text viewer.
   
   
3. Identify the authentication record, including the Username, Timestamp, and World ID for the session:
   
   
   • ESXi Shell login at the console appears similar to:
     
     2011-08-29T18:01:00Z login[64386]:root login on 'char/tty/1'
     
     
   • ESXi Shell login via interactive SSH appears similar to:
     
     2011-08-29T18:01:00Z sshd[12345]: Connection from10.11.12.13 port 2605
2011-08-29T18:01:00Z sshd[12345]:Accepted keyboard-interactive/pam for root from 10.11.12.13 port 2605 ssh2
2011-08-29T18:01:00Z sshd[64386]: Session opened for 'root' on /dev/char/pty/t0
2011-08-29T18:01:00Z sshd[12345]: Session closed for 'root' on /dev/char/pty/t0
...
2011-08-29T18:35:05Z sshd[12345]: Session closed for 'root' 2
     
     
   • ESXi Shell login via SSH with public key appears similar to:
     
     2011-08-29T18:01:00Z sshd[12345]: Connection from10.11.12.13 port 2605
2011-08-29T18:01:00Z sshd[12345]:Accepted publickey for root from 10.11.12.13 port 2605 ssh2
2011-08-29T18:01:00Z sshd[64386]: Session opened for 'root' on /dev/char/pty/t0
2011-08-29T18:01:00Z sshd[12345]: Session closed for 'root' on /dev/char/pty/t0
...
2011-08-29T18:35:05Z sshd[12345]: Session closed for 'root' 2
     
   
   Each of these authentication records indicate a successful authentication for the userroot on August 29th at 18:01 GMT. The SSH methods also include the IP address tha the connection was initated from. The shell session is being handled by world64386.
   
   
4. Close the log file /var/log/auth.log.
   
   
5. Open the log file /var/log/shell.log in a text editor or viewer.
   
   
6. Identify commands entered which contain the same World ID as identified in Step 3, appearing similar to:
   
   2011-08-29T18:01:01Z shell[64386]: Interactive shell session started
2011-08-29T18:05:02Z shell[64386]: cd /var/log
2011-08-29T18:05:03Z shell[64386]: ls
2011-08-29T18:13:04Z shell[64386]: vmware -v
2011-08-29T18:35:05Z shell[64386]: exit
   
   Since the commands were entered in the console session handled by world ID 64386, we know that they correspond to the authentication session established by userroot as described in Step 3.