Monitoring Root password changes

[Anne-Marie Curran]

I'm looking to create an alert for when any of our esxi hosts root passwords are changed/updated. Suprisingly this does not seem to be in the predefined alerts in vsphere! 
Any ideas how I can implement this ?

[a.tinivelli]

if you want to implement this kind of monitoring, you should use syslog to redirect all events to an appropriate syslog server

https://knowledge.broadcom.com/external/article/318939/configuring-syslog-on-esxi.html

------------------------------
Alessandro Tinivelli | blog.tinivelli.com | www.revobyte.it | VMCE 2024 | Veeam Legend | VCP-DCV 2023 | VVSPHT 2023 | vExpert 2024
------------------------------

[CTRIM]

Syslog

Create a query to search for log entries related to root password changes. For example, search for keywords like "password change" or "root password".