PCNS appliance cannot login to hosts

[Anonymous user]

Hello everyone,

We recently deployed a PCNS aplliance (4.2) to a vsphere 6.0 environment with 2 hosts and everything seems to be working OK (VM shutdown, host protection, etc.).

Still there seems to be an issue as PCNS tries to login not only to the vcenter (which works fine as seen in the bottom line in my screenshot) but also to the hosts using the same credentials which fails.

sKJN6%2BPZFLGb8RVIiN4jow%3D%3D&Rest-Api-Key=d3Bhc3F1aWw6NjM3MzU2MWEtNzYzMC00OTc5LTkyMTAtOTJjYTU0NGEwZWFl.jpeg

The user has the Administrator role on both hosts and can be used otherwise to login (e.g. vsphere-client).

To be honest I don't know why PCNS is even trying to login to the hosts directly.

Can anyone help?

[BillP]

Hi,

The shutdown process is as follows 

1. PowerChute reports that the UPS is on battery.

2. Shutdown delay for the On Battery event elapses. PowerChute starts a maintenance mode task on each Host. At the same time it sends a command to turn off the UPS or Outlet Group.

3. PowerChute starts VM shutdown followed by vApp shutdown.

4. VM/vApp shutdown durations elapse and PowerChute gracefully shuts down the vCenter Server VM.

5. vCenter VM shutdown duration elapses.

6. PowerChute starts executing the shutdown command file. - VM & vApp Shutdown enabled with a 120 second delay (i.e. 120 seconds allocated for each action to complete). - The option to turn off the UPS or Outlet Group is enabled. - A shutdown command file has been configured with a 120 second duration. When a critical UPS event, such as UPS on Battery occurs, the following sequence is triggered:

7. Shutdown command file duration elapses. PowerChute shuts down the VMware hosts using the order on the VMware Host Protection page. (The host running the vCenter VM will be shut down last in this scenario).

8. OS shutdown sequence starts on the PowerChute physical machine.

9. After a 70 second delay the OS starts to shut down.

10. UPS waits for greater of Low Battery Duration/Maximum Required Delay (NonOutlet Aware UPS‟s) or the Outlet Group Power Off Delay (initiated during step 2).

11. UPS turns off after the user-configurable Shutdown Delay time has elapsed or the Outlet Group turns off after the power off Delay elapses.

During step 7 PCNS contacts the host to power them down using the credentials it uses to communicate with vCenter. The credentials are case sensitive so it is possible that is causing the login error. See FAQ FA349917

[Anonymous user]

I've the same issue... the problem is that, with shared account, vCenter 6.5 needs to login with user@vsphere.local and both esxi host need to login only with user, without domain. I don't have any ideas at the moment... Do you have any suggestion?

Thanks

Dario

[BillP]

Hi,

When connecting directly to ESXi hosts PowerChute just uses user as the account name since ESXi will not allow @vsphere.local for a username. 

[Anonymous user]

On 7/24/2018 1:24 PM, Bill said:

Hi,

When connecting directly to ESXi hosts PowerChute just uses user as the account name since ESXi will not allow @vsphere.local for a username. 

That may be the way it is supposed to work, but in my case, also on vmWare 6.5 it appears that PowerChute is sending the full name when attempting to log into the hosts as I see this issue since we have upgraded vmWare. As you can see from the error logged below it is attempting to log into ESXi as apc@vsphere.local.

[Anonymous user]

I confirm! If under pcns settings I set the user without domain, it connects correctly to esxi host, but don't connect to vCenter...

[BillP]

Hi,

I have created a pcnstester account on the 6.5 VCSA in the vsphere.local domain 

h79jnQQSdFWQwB2Bj%2FDy5g%3D%3D.png

Added the user and given it administrator privileges via roles

CdyJz6bbJDi04Ofk0YbcOA%3D%3D.png

I then created the same user in the ESXi 6.5 host using the same password and gave it administrator privileges on the host. 

0QG%2BjCmsBgut4QtO8jv7iw%3D%3D.png

Then when configuring PowerChute I selected managed by vCenter and added the pcnstester credentials

i93XvFBN9LjiNavJBroyZQ%3D%3D.png

The pcnstester account can communicate with both VCSA and the host/s

[Anonymous user]

I followed the same procedure:

Then:

Added the user to the host and gave it permission:

When I attempt to reconfigure the PowerChute settings using "apcpcns" as you did I get the following error:

oOdtO9gQPNcxBHTl7C4SCA%3D%3D.png

If I use apcpcns@vsphere.local it passes this screen but is still unable to log into the hosts as it is trying to log in as apcpcns@vsphere.local.

omiDHPseVYCQXmjfs1hn2g%3D%3D.png

[Anonymous user · Accepted solution]

I think I figured out the problem.  I assume you, like me, have your AD domain set as the default domain in vCenter.  It appears that you can either set your default domain back to vsphere.local or possibly add the APC user to your AD domain.  Maybe APC will answer to what happens if you add the user to your AD domain and AD is not available as the domain controller VM has already be shut down but perhaps since it is already logged in it doesn't matter. I have just changed my default domain to vsphere.local and will see if it produces any problems anywhere else. Hope this helps!

r0NUSf7q7r5TMa8l8L%2BhHA%3D%3D.png

id0dNLbHGXCQlmy76pQo7A%3D%3D.png

[Anonymous user]

Hi Nick! I confirm that if i set vsphere.local as default domain, it seems that pcns can login correctly without specifying domain.

I suggest APC to update your documentation that is very outdated.

Thanks!

[Anonymous user]

thank you very much 

i am looking for this a lot of time 

in the user manual from APC this not included