ESXI BUG

[BITEL1]

Hello, after a certain number of days I get this type of black screen with a complete ESXI crash and the server has to be restarted.
Could you tell me where this could be coming from?
Thank you

[louyo]

same number of days?

idrac log entry?

ESXi Log entries? 

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.monitoring.doc/GUID-832A2618-6B11-4A28-9672-93296DA931D0.html 

run  Dell diagnostics?

run memtest86?

check disk(s)?

basic troubleshooting?

[BITEL1]

Hello, the physical server seems to have no hardware problems.

This first happened about 30 days ago.
Is it possible to send you the logs to have a look?
If so, which logs would you like ?
I look forward to hearing from you.

[louyo]

I would start with the idrac logs in the maintenance section, make sure there was no power incidents.

Then look in /var/log/syslog.log. Search for the words fail and error. 

Maybe look in /var/log/loadESX.log to see if there were any restarts. 

 

Lou

[BITEL1]

Hello, I have just looked at the Logs and found that an abnormal process started on its own.
What can be done to prevent this from happening again?
I repeat that the ports are open only to certain IPs in particular.

[louyo]

Are you port forwarding from the Internet? I don't consider that secure. 

[BITEL1]

The host machine has an IP address, enabling it to be accessed from the Internet.
Access to the SSH console is blocked and filtered with certain IP addresses only, so normally it's not possible for an intruder to connect to SSH.

[BITEL1]

I noticed in the Logs that lots of services started automatically without anything I asked.
How can I do to prevent this from happening ?

2023-07-28T11:26:28Z init: starting pid 2331007, tty '': '/usr/lib/vmware/vmksummary/log-bootstop.sh stop'
2023-07-28T11:26:28Z init: starting pid 2331010, tty '': '/bin/shutdown.sh'
2023-07-28T11:26:28Z init: starting pid 2331011, tty '': '/usr/lib/vmware/random-seed/bin/storeRandomSeed.sh'
2023-07-28T11:26:28Z init: starting pid 2331013, tty '': '/bin/vmware-autostart.sh stop'
2023-07-28T11:26:28Z init: starting pid 2331022, tty '': '/bin/services.sh stop'

[louyo]

log into ESXi web interface.

Host/manage/services. Select the service, Actions/policy and change accordingly.

Lou

[BITEL1]

I've disabled unnecessary services and set up ACL rules for which services are required.
What else should I check ?