6.7

Table Of Contents
n
For legacy ESXi 4.x hosts, vSphere HA writes
to /var/log/vmware/fdm on local disk, as well as syslog if it is
configured.
n
For legacy ESX 4.x hosts, vSphere HA writes
to /var/log/vmware/fdm.
Secure vSphere HA
logins
vSphere HA logs onto the vSphere HA agents using a user account,
vpxuser, created by vCenter Server. This account is the same account
used by vCenter Server to manage the host. vCenter Server creates a
random password for this account and changes the password periodically.
The time period is set by the vCenter Server
VirtualCenter.VimPasswordExpirationInDays setting. Users with
administrative privileges on the root folder of the host can log in to the
agent.
Secure communication All communication between vCenter Server and the vSphere HA agent is
done over SSL. Agent-to-agent communication also uses SSL except for
election messages, which occur over UDP. Election messages are verified
over SSL so that a rogue agent can prevent only the host on which the
agent is running from being elected as a master host. In this case, a
configuration issue for the cluster is issued so the user is aware of the
problem.
Host SSL certificate
verification required
vSphere HA requires that each host have a verified SSL certificate. Each
host generates a self-signed certificate when it is booted for the first time.
This certificate can then be regenerated or replaced with one issued by an
authority. If the certificate is replaced, vSphere HA needs to be reconfigured
on the host. If a host becomes disconnected from vCenter Server after its
certificate is updated and the ESXi or ESX Host agent is restarted, then
vSphere HA is automatically reconfigured when the host is reconnected to
vCenter Server. If the disconnection does not occur because vCenter
Server host SSL certificate verification is disabled at the time, verify the
new certificate and reconfigure vSphere HA on the host.
vSphere HA Admission Control
vSphere HA uses admission control to ensure that sufficient resources are reserved for virtual machine
recovery when a host fails.
Admission control imposes constraints on resource usage. Any action that might violate these constraints
is not permitted. Actions that might be disallowed include the following examples:
n
Powering on a virtual machine
n
Migrating a virtual machine
n
Increasing the CPU or memory reservation of a virtual machine
vSphere Availability
VMware, Inc. 20