Virtualization

VMware ESXi hostd logs

ESXi 8 hostd authentication and VM tasks from one host, four administrators and two automated API clients. Native messages sit inside a custom ECS wrapper.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/virtualization-vmware-esxi-hostd/generator.yml \
  --id esxi-hostd \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
login	API login	48.44%	authentication
logout	API logout	48.44%	authentication
auth-failed	Rejected password	1.18%	authentication
vm-snapshot-request	VM snapshot task	0.71%	configuration
task-completed	Task completed successfully	0.97%	configuration
vm-poweroff-request	VM power-off task	0.13%	configuration
vm-poweron-request	VM power-on task	0.13%	configuration

Realism Features

Independent API sessions with shared account attempt limits
Ordinary and episode VMs use the same restoration timing
Selected native lines only; PAM diagnostics, snapshot cleanup and most subsystems are omitted
ECS and vmware.esxi are a custom mapping; live parser compatibility is unverified

Sample Output

{
  "@timestamp": "2026-09-21T00:02:39.760Z",
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "action": "login",
    "category": [
      "authentication"
    ],
    "kind": "event",
    "original": "2026-09-21T00:02:39.760Z In(166) Hostd[2103838]: [Originator@6876 sub=Vimsvc.ha-eventmgr opID=esxui-e3e6-d1bf sid=7926f1f1] Event 6549 : User svc-backup@10.20.2.32 logged in as pyvmomi Python/3.8.18 (VMkernel; 8.0.2; x86_64)",
    "outcome": "success",
    "type": [
      "start"
    ]
  },
  "host": {
    "name": "esx-04.example.test"
  },
  "log": {
    "file": {
      "path": "/var/run/log/hostd.log"
    },
    "level": "info"
  },
  "process": {
    "name": "Hostd",
    "pid": 2103838
  },
  "related": {
    "ip": [
      "10.20.2.32"
    ],
    "user": [
      "svc-backup"
    ]
  },
  "source": {
    "ip": "10.20.2.32"
  },
  "user": {
    "name": "svc-backup"
  },
  "vmware": {
    "esxi": {
      "client_agent": "pyvmomi Python/3.8.18 (VMkernel; 8.0.2; x86_64)",
      "message": "Event 6549 : User svc-backup@10.20.2.32 logged in as pyvmomi Python/3.8.18 (VMkernel; 8.0.2; x86_64)",
      "subsystem": "Vimsvc.ha-eventmgr"
    }
  }
}

Parameters

Parameter	Default	Description
anomaly_mode	true	Include recurring complete chains.
anomaly_interval_hours	24	Recurrence interval, 2-8760 hours.
host_name	esx-04.example.test	ESXi host name.

Related Generators

Virtualization

VMware vCenter vpxd Events

VMware vCenter Server 8.0 vpxd events forwarded over RFC 5424 syslog and indexed by the Elastic VMware vSphere integration (vsphere.log): API logins and logouts, failed SSO logins, VM power and reconfiguration, and permission changes, with the native syslog line in event.original. About 8,100 records a day from one vCenter: four service accounts around the clock and eight staff accounts on a UTC working day. Recurring episodes show three to five failed SSO logins for one administrator, then that administrator's login and an Admin permission grant.

Virtualization

Microsoft Hyper-V VMMS Checkpoint and Merge Failures

Microsoft-Windows-Hyper-V-VMMS-Admin error records for failed VM checkpoints and background disk merges on four Hyper-V hosts with 60 VMs, as Winlogbeat-style ECS JSON with the raw Windows event XML in event.original. About 120 records a day, most of them in the nightly 22:00-05:00 backup window; ten VMs with recurring checkpoint trouble carry most failures. Recurring episodes show one of those VMs with a cancelled checkpoint followed by three failed checkpoint attempts, each followed by a disk merge failure.

Virtualization

Proxmox VE logs

About 12,240 records/day from one node, twelve VMs, administrators, automation accounts and an API-token monitor.