ESXCLI Commands

esxcli system Commands

Command	Description	Options Help
system account add	Create a new local user account.	--description | -d User description, e.g. full name. --id | -i User ID, e.g. "administrator". (required) --password | -p User password. (secret) --password-confirmation | -c Password confirmation. Required if password is specified. (secret) --help Show the help message.
system account list	List local user accounts.	--help Show the help message.
system account remove	Remove an existing local user account.	--id | -i ID of user to be removed. (required) --help Show the help message.
system account set	Modify an existing local user account.	--description | -d User description, e.g. full name. --id | -i User ID, e.g. "administrator". (required) --password | -p User password. (secret) --password-confirmation | -c Password confirmation. Required if password is specified. (secret) --help Show the help message.
system auditrecords get	Information about audit record recording.	--help Show the help message.
system auditrecords local disable	Disable audit record recording.	--help Show the help message.
system auditrecords local enable	Enable audit record recording.	--directory The audit log directory. --help Show the help message.
system auditrecords local set	Configure audit record recording.	--directory The audit log directory. --size The size of the audit log (in KiB). (required) --help Show the help message.
system auditrecords remote disable	Disable audit record handling for remote hosts.	--help Show the help message.
system auditrecords remote enable	Enable audit record handling for remote hosts.	--directory The audit log directory. --help Show the help message.
system boot device get	Get the systems boot device.	--help Show the help message.
system clock get	Display the current system clock parameters.	--help Show the help message.
system clock set	Set system clock parameters.	--max-neg-phase | -n max negative phase correction --max-phase-corrections | -m max number of phase corrections --max-pos-phase | -p max positive phase correction --help Show the help message.
system coredump file add	Create a VMkernel Dump VMFS file for this system.	--auto | -a Automatically create a file if none found and autoCreateDumpFile kernel option is set. --datastore | -d Manually specify the datastore the Dump File is created in. If not provided, a datastore of sufficient size will be automatically chosen. --enable | -e Enable diagnostic file after creation. --file | -f Manually specify the file name of the created Dump File. If not provided, a unique name will be chosen. --size | -s Manually set the size in MB of the created Dump File. If not provided, a default size for the current machine will be calculated. --help Show the help message.
system coredump file get	Get the dump file path. This command will print the path to the active and/or configured VMFS Dump File.	--help Show the help message.
system coredump file list	List the active and configured VMFS Diagnostic Files.	--help Show the help message.
system coredump file remove	Remove a VMkernel Dump VMFS file from this system.	--file | -f Specify the file name of the Dump File to be removed. If not given, the configured dump file will be removed. --force | -F Deactivate and unconfigure the dump file being removed. This option is required if the file is active. --help Show the help message.
system coredump file set	Set the active and configured VMkernel Dump VMFS file for this system.	--enable | -e Enable or disable the VMkernel dump file. This option cannot be specified when unconfiguring the dump file. --path | -p The path of the VMFS Dump File to use. This must be a pre-allocated file. --smart | -s This flag can be used only with --enable=true. It will cause the file to be selected using the smart selection algorithm. --unconfigure | -u Unconfigure the current VMFS Dump file. --help Show the help message.
system coredump network check	Check the status of the configured network dump server	--help Show the help message.
system coredump network get	Get the currently configured parameters for network coredump, if enabled.	--help Show the help message.
system coredump network set	Set the parameters used for network core dump	--enable | -e Enable network dump. This option cannot be specified when setting the dump parameters below. --interface-name | -v An active interface to be used for the network core dump. Required option when setting dump parameters. --server-ip | -j IP address of the core dump server (IPv4 or IPv6). Required when setting dump parameters. --server-ipv4 | -i IPv4 address of the core dump server.(deprecated, use -j|--server-ip instead) --server-port | -o Port on which the core dump server is listening. (Optional) --help Show the help message.
system coredump partition get	Get one of the dump partition configured values. This command will print either the active dump partition or the configured dump partition depending on the flags passed.	--help Show the help message.
system coredump partition list	List all of the partitions on the system that have a partition type matching the VMware Core partition type. Also indicate which partition, if any, is being used as the system's dump partition and which is configured to be used at next boot.	--help Show the help message.
system coredump partition set	Set the specific VMkernel dump partition for this system. This will configure the dump partition for the next boot. This command will change the active dump partition to the partition specified.	--enable | -e Enable or disable the VMkernel dump partition. This option cannot be specified when setting or unconfiguring the dump partition. --partition | -p The name of the partition to use. This should be a device name with a partition number at the end. Example: naa.xxxxx:1 --smart | -s This flag can be used only with --enable=true. It will cause the best available partition to be selected using the smart selection algorithm. --unconfigure | -u Set the dump partition into an unconfigured state. This will remove the current configured dump partition for the next boot. This will result in the smart activate algorithm being used at the next boot. --help Show the help message.
system hostname get	Get the host, domain or fully qualified name of the ESX host.	--help Show the help message.
system hostname set	This command allows the user to set the hostname, domain name or fully qualified domain name of the ESX host.	--domain | -d The domain name to set for the ESX host. This option is mutually exclusive with the --fqdn option. --fqdn | -f Set the fully qualified domain name of the ESX host. --host | -H The host name to set for the ESX host. This name should not contain the DNS domain name of the host and can only contain letters, numbers and '-'. NOTE this is not the fully qualified name, that can be set with the --fqdn option. This option is mutually exclusive with the --fqdn option. --help Show the help message.
system maintenanceMode get	Get the maintenance mode state of the system.	--help Show the help message.
system maintenanceMode set	Enable or disable the maintenance mode of the system.	--enable | -e Maintenance mode state. (required) --timeout | -t Timeout in seconds to wait for entering the new state. Zero (default) means no timeout. The host will enter maintenance mode when there are no running virtual machines on the host. The user is required to power off or evacuate them. Exiting maintenance mode is done when there are no running mainenance operations. --vsanmode | -m Action the VSAN service must take before the host can enter maintenance mode (default ensureObjectAccessibility). Allowed values are: ensureObjectAccessibility: Evacuate data from the disk to ensure object accessibility in the vSAN cluster, before entering maintenance mode. evacuateAllData: Evacuate all data from the disk before entering maintenance mode. noAction: Do not move vSAN data out of the disk before entering maintenance mode. --help Show the help message.
system module get	Show information for a VMkernel module.	--module | -m The name of the VMkernel module. (required) --help Show the help message.
system module list	List the VMkernel modules that the system knows about.	--enabled | -e List the enabled / disabled VMkernel modules and device drivers. --loaded | -l List the loaded / not loaded VMkernel modules and device drivers. --help Show the help message.
system module load	Load a VMkernel module with the given name if it is enabled. If the module is disabled then the use of --force is required to load the module.	--force | -f Ignore the enabled/disabled state of this module and force it to load. --module | -m The name of the VMkernel module to load. (required) --help Show the help message.
system module set	Allow enabling and disabling of a VMkernel module.	--enabled | -e Set to true to enable the module, set to false to disable the module. (required) --force | -f Skip VMkernel module validity checks and set options for a module (or alias) with the given name. --module | -m The name of the VMkernel module to set options for. (required) --help Show the help message.
system module parameters clear	Clear the load time parameters for a given VMkernel module.	--module | -m The name of the VMkernel module to clear parameters for. (required) --help Show the help message.
system module parameters copy	Copy the load time parameters from one VMkernel module to another.	--force | -f Skip VMkernel module validity checks for the source VMkernel module. --parameter-keys | -p Parameter key that should get copied. (required) --source | -s The name of the source VMkernel module. (required) --target | -t The name of the target VMkernel module. (required) --help Show the help message.
system module parameters list	List the parameters, a descriptions of each parameter supported for a given module name and the user defined value for each parameter.	--module | -m The name of the VMkernel module to get the option string for. (required) --help Show the help message.
system module parameters set	Set the load time parameters for the given VMkernel module.	--append | -a Append the specified parameter string to the currently configured parameter string for the VMkernel module. If --append is not specified, the parameter string currently configured for the VMkernel module will be replaced by the specified parameter string. --force | -f Skip VMkernel module validity checks and set parameters for a module (or alias) with the given name. --module | -m The name of the VMkernel module to set parameters for. (required) --parameter-string | -p The string containing the parameters for this module. (required) --help Show the help message.
system ntp get	Display Network Time Protocol configuration	--help Show the help message.
system ntp set	Configures the ESX Network Time Protocol agent.	--enabled | -e Start or stop ntpd. Values: [yes|no, true|false, 0|1] --loglevel | -l Syslog logging level: debug: Most detailed logging level. error: Least detailed logging, Reports only errors. info: Reports normal actions in addition to warnings, events. warning: Reports only warnings or errors. --reset | -r Restore the NTP configuration to factory defaults. --server | -s Provide one or more NTP servers as a fully qualified domain name or IP address. --help Show the help message.
system ntp config get	Display Network Time Protocol configuration.	--help Show the help message.
system permission list	List permissions defined on the host.	--help Show the help message.
system permission set	Set permission for a user or group.	--group | -g Specifies that the supplied ID refers to a group. ESXi local groups are not supported. --id | -i ID of user or group. Domain users or groups should be specified as "DOMAIN\user_name" or "DOMAIN\group_name". (required) --role | -r Name of role that specifies user access rights. Admin: Full access rights NoAccess: Used for restricting granted access. E.g. to deny access for some user whose group already has access. ReadOnly: See details of objects, but not make changes (required) --help Show the help message.
system permission unset	Remove permission for a user or group.	--group | -g Specifies that the supplied ID refers to a group. --id | -i ID of user or group. (required) --help Show the help message.
system process list	List the VMkernel UserWorld processes currently on the host.	--help Show the help message.
system process stats load get	System load average over the last 1, 5 and 15 minutes.	--help Show the help message.
system process stats running get	Number of currently running processes.	--help Show the help message.
system ptp get	Display Precision Time Protocol configuration	--help Show the help message.
system ptp set	Configures the ESX Precision Time Protocol agent.	--enabled | -e Start or stop ptpd. Values: [yes|no, true|false, 0|1] --loglevel | -l Syslog logging level: [debug, info, warning, error] --reset | -r Restore the PTP configuration to factory defaults --help Show the help message.
system ptp stats get	Report operational state of Precision Time Protocol Daemon	--help Show the help message.
system secpolicy domain list	List the enforcement level for each domain.	--help Show the help message.
system secpolicy domain set	Set the enforcement level for a domain in the system. Any option specified here is not persistent and will not survive a reboot of the system.	--all-domains | -a All domains. --level | -l The enforcement level. (required) --name | -n The domain name. --help Show the help message.
system security certificatestore add	Add a new CA certificate to the CA certificate store.	--filename | -f Absolute path to certificate file in PEM format, located on the ESXi host. (required) --help Show the help message.
system security certificatestore list	List all certificates in the CA certificate store.	--help Show the help message.
system security certificatestore remove	Remove a certificate from the CA certificate store.	--filename | -f Absolute path to the file in PEM format, located on the ESXi host, describing the certificate to be removed. --issuer | -i Issuer name of the certificate to be removed. Also requires --serial. --serial | -s Serial number of the certificate to be removed. Also requires --issuer. --help Show the help message.
system security fips140 rhttpproxy get	Get FIPS140 mode of rhttpproxy.	--help Show the help message.
system security fips140 rhttpproxy set	Set FIPS140 mode of rhttpproxy.	--enable | -e Enable/disable FIPS140 mode for rhttpproxy. (required) --help Show the help message.
system security fips140 ssh get	Get FIPS140 mode of ssh.	--help Show the help message.
system security fips140 ssh set	Set FIPS140 mode of ssh.	--enable | -e Enable/disable FIPS140 mode for ssh. (required) --help Show the help message.
system settings advanced add	Add a user defined advanced option to the /UserVars/ advanced option tree.	--description | -d Description of the new option. (required) --hidden | -H Whether the option is hidden. --int-default | -i The default value of the new option (integer option only, required). --max | -M The maximum allowed value (integer option only, required). --min | -m The minimum allowed value (integer option only, required). --option | -o The name of the new option. Valid characters: letters, digits and underscore. (required) --string-default | -s The default value of the new option (string option only). An empty string is assumed if not specified. --type | -t The type of the new option. Supported values: integer: Advanced option with integer value. string: Advanced option with string value. (required) --help Show the help message.
system settings advanced list	List the advanced options available from the VMkernel.	--delta | -d Only display options whose values differ from their default. --option | -o Only get the information for a single VMkernel advanced option. --tree | -t Limit the list of advanced option to a specific sub tree. --help Show the help message.
system settings advanced remove	Remove a user defined advanced option from the /UserVars/ advanced option tree.	--option | -o The name of the option to remove (without the /UserVars/ prefix as it is implied). (required) --help Show the help message.
system settings advanced set	Set the value of an advanced option.	--default | -d Reset the option to its default value. --int-value | -i If the option is an integer value use this option. --option | -o The name of the option to set the value of. Example: "/Misc/HostName" (required) --string-value | -s If the option is a string use this option. --help Show the help message.
system settings kernel list	List VMkernel kernel settings.	--delta | -d Only display options whose values differ from their default. --option | -o The name of the VMkernel kernel setting to get. --help Show the help message.
system settings kernel set	Set a VMKernel setting.	--setting | -s The name of the VMKernel setting to set. (required) --value | -v The value to set the setting to. (required) --help Show the help message.
system settings keyboard layout get	Get the keyboard layout	--help Show the help message.
system settings keyboard layout list	List the keyboard layout	--help Show the help message.
system settings keyboard layout set	Set the keyboard layout	--layout | -l The name of the layout to set --no-persist Only apply this layout for the current boot --help Show the help message.
system shutdown poweroff	Power off the system. The host must be in maintenance mode.	--delay | -d Delay interval in seconds --reason | -r Reason for performing the operation (required) --help Show the help message.
system shutdown reboot	Reboot the system. The host must be in maintenance mode.	--delay | -d Delay interval in seconds --reason | -r Reason for performing the operation (required) --help Show the help message.
system slp search	Perform SLP search for neighboring services	--node | -n Optional, host FQDN or IP address to connect to. Use -P to control protocol used. --port | -p Optional, override the default port value 427. --protocol | -P Optional, override unicast protocol: [tcp, udp], default tcp, requires -n. --service | -s Optional, the service name to search for. Defaults to 'service-agent'. --help Show the help message.
system slp stats get	Report operational state of Service Location Protocol Daemon	--help Show the help message.
system snmp get	Get SNMP Agent configuration	--help Show the help message.
system snmp hash	Generate localized hash values based on this agents snmp engine id.	--auth-hash | -A Secret to use when generating authentication hash. This should be a filename unless --raw-secret is specified. The authentication hash is used in the --users option of 'esxcli system snmp set' (required secret) --priv-hash | -X Secret to use when generating privacy hash. This should be a filename unless --raw-secret is specified. The privacy hash is used in the --users option of 'esxcli system snmp set'. (secret) --raw-secret | -r Make --auth-hash and --priv-hash options read raw secret from command line instead of file. --help Show the help message.
system snmp set	This command allows the user to set up ESX SNMP agent.	--authentication | -a Set default authentication protocol. Values: none, SHA1 --communities | -c Set up to ten communities each no more than 64 characters. Format is: community1[,community2,...] (this overwrites previous settings) --enable | -e Start or stop SNMP service. Values: [yes|no, true|false, 0|1] --engineid | -E Set SNMPv3 engine id. Must be at least 10 to 32 hexadecimal characters. 0x or 0X is stripped if found as well as colons (:) --hwsrc | -y Where to source hardware events from IPMI sensors or CIM Indications. One of: indications|sensors --largestorage | -s Support large storage for hrStorageAllocationUnits * hrStorageSize. Values: [yes|no, true|false, 0|1]. Control how the agent reports hrStorageAllocationUnits, hrStorageSize and hrStorageUsed in hrStorageTable. Setting this directive to 1 to support large storage with small allocation units, the agent re-calculates these values so they all fit Integer32 and hrStorageAllocationUnits * hrStorageSize gives real size of the storage ( Note: hrStorageAllocationUnits will not be real allocation units if real hrStorageSize won't fit into Integer32 ). Setting this directive to 0 turns off this calculation and the agent reports real hrStorageAllocationUnits, but it might report wrong hrStorageSize for large storage because the value won't fit into Integer32. --loglevel | -l System Agent syslog logging level: debug|info|warning|error --notraps | -n Comma separated list of trap oids for traps not to be sent by agent. Use value 'reset' to clear setting --port | -p Set UDP port to poll snmp agent on. The default is udp/161. May not use ports 32768 to 40959 --privacy | -x Set default privacy protocol. Values: none, AES128 --remote-users | -R Set up to five inform user ids. Format is: user/auth-proto/-|auth-hash/priv-proto/-|priv-hash/engine-id[,...] Where user is 32 chars max. auth-proto is none|SHA1, priv-proto is none|AES. '-' indicates no hash. engine-id is hex string '0x0-9a-f' up to 32 chars max. --reset | -r Return agent configuration to factory defaults --syscontact | -C System contact string as presented in sysContact.0. Up to 255 characters --syslocation | -L System location string as presented in sysLocation.0. Up to 255 characters. --targets | -t Set up to three targets to send SNMPv1 traps to. Format is: ip-or-hostname[@port]/community[,...] The default port is udp/162. (this overwrites previous settings) --users | -u Set up to five local users. Format is: user/-|auth-hash/-|priv-hash/model[,...] Where user is 32 chars max. '-' indicates no hash. Model is one of (none|auth|priv). --v3targets | -i Set up to three SNMPv3 notification targets. Format is: ip-or-hostname[@port]/remote-user/security-level/trap|inform[,...]. --help Show the help message.
system snmp test	Verify ESX SNMP notifications can be delivered to target destinations.	--auth-hash | -A Optionally test authentication secret generates matching hash for user --priv-hash | -X Optionally test privacy secret generates matching hash for user --raw-secret | -r Make -A and -X flags read raw secret from command line instead of file. --user | -u Validate a given SNMPv3 user name exists --help Show the help message.
system stats installtime get	Display the date and time when this system was first installed. Value will not change on subsequent updates.	--help Show the help message.
system stats uptime get	Display the number of microseconds the system has been running.	--help Show the help message.
system syslog mark	Issue a message to all outputs.	--message | -s The message to issue. (required) --help Show the help message.
system syslog reload	Reload the log daemon to apply any new configuration options.	--help Show the help message.
system syslog config get	Show the current global configuration values.	--help Show the help message.
system syslog config set	Set global log configuration options.	--check-ssl-certs Verify remote SSL certificates against the local CA Store. --crl-check Check revocation status of all the certificates in SSL certificate chain. --default-rotate Default number of rotated local logs to keep. --default-size Default size of local logs before rotation, in KiB. --default-timeout Default network retry timeout in seconds if a remote server fails to respond. --drop-log-rotate Number of rotated dropped log files to keep. --drop-log-size Size of dropped log file before rotation, in KiB. --logdir The directory to output local logs to. --logdir-unique Place logs in a unique subdirectory of logdir, based on hostname. --loghost The remote host(s) to send logs to. --queue-drop-mark Message queue capacity after which messages are dropped. --reset Reset values to default. --x509-strict Strict X.509 compliance when checking SSL certificates. --help Show the help message.
system syslog config logger list	Show the currently configured sub-loggers.	--help Show the help message.
system syslog config logger set	Set configuration options for a specific sub-logger.	--id The id of the logger to configure. (required) --reset Reset values to default. --rotate Number of rotated logs to keep for a specific logger (requires --id). --size Set size of logs before rotation for a specific logger, in KiB (requires --id). --help Show the help message.
system time get	Disply the current system time.	--help Show the help message.
system time set	Set the system clock time. Any missing parameters will default to the current time	--day | -d Day --hour | -H Hour --min | -m Minute --month | -M Month --sec | -s Second --year | -y Year --help Show the help message.
system uuid get	Get the system UUID.	--help Show the help message.
system version get	Display the product name, version and build information.	--alternate | -a Report version of software image in alternate boot bank if any. --help Show the help message.
system visorfs get	Obtain status information on the memory filesystem as a whole.	--help Show the help message.
system visorfs ramdisk add	Add a new Visorfs RAM disk to the ESXi Host and mount it.	--max-size | -M Maximum size (max reservation in MiB) (required) --min-size | -m Minimum size (min reservation in MiB) (required) --name | -n Name for the ramdisk (required) --permissions | -p Permissions for the root of the ramdisk (mode) (required) --target | -t Mountpoint for the ramdisk (absolute path) (required) --help Show the help message.
system visorfs ramdisk list	List the RAM disks used by the host.	--help Show the help message.
system visorfs ramdisk remove	Remove a Visorfs RAM disk from the ESXi Host.	--target | -t Mountpoint for the ramdisk (absolute path) (required) --help Show the help message.
system visorfs tardisk list	List the tardisks used by the host.	--help Show the help message.
system wbem get	Display WBEM Agent configuration.	--help Show the help message.
system wbem set	This command allows the user to set up ESX CIMOM agent.	--auth | -a Specify how to authorize incoming requests. Values are password, certificate, password is by default. Changes take effect when --enable is specified. --enable | -e Start or stop the WBEM services (sfcbd, openwsmand). Values: [yes|no, true|false, 0|1]. --enable-https | -H Enable or disable https connection to sfcbd. Values: [yes|no, true|false, 0|1]. --http-max-content-length | -M Maximum allowed length in bytes of http requests. Default is 1048576. --http-procs Maximum number of simultaneous HTTP client connections before blocking new incoming HTTP requests. Default is 2. --https-procs Maximum number of simultaneous HTTPS client connections before blocking new incoming HTTPS requests. Default is 4. --keepalive-max-request | -k Specify the maximum number of consecutive requests on one connection. Setting it to 0 will effectively disable HTTP keep-alive. Default is 10. --keepalive-timeout | -K Specify the maximum time in seconds an sfcb HTTP process will wait between two requests on one connection before terminating. Setting it to 0 will disable HTTP keep-alive. Default is 1. --loglevel | -l Syslog logging level: debug|info|warning|error. --max-msg-len | -m Maximum allowed length in bytes of wbem messages. Default is 40000000. --port | -p Set the TCP port on which the CIMOM listens for requests. The default is 5989. --protocols | -P Enable or disable SSL protocols. To reset to factory defaults specify 'reset' which allows only TLS 1.2 unless system defaults have been changed.Values can be one of: [tlsv1, tlsv1.1, reset] and setting protocols here overrules system defaults. Multiple protocols can be provided using format -P protocol1 -P protocol2. Command takes effect immediately. --provider-sample-interval | -i The interval in seconds at which the provider manager is checking for idle providers. Default is 30. --provider-timeout-interval | -I The interval in seconds before an idle provider gets unloaded by the provider manager. Default is 120. --prov-procs Maximum number of simultaneous provider processes. After this point if a new incoming request requires loading a new provider, then one of the existing providers will first be automatically unloaded. Default is 16. --readonly | -R Set readonly mode. Default is false. --reset | -r Restore the WBEM configuration to factory defaults. --rp-override | -o This overrides the configured resource pool size of a provider. --shutdown-interval | -s Duration in seconds to wait for provider to exit. Default is 3. --ssl-cipher-list | -S The cipher list consists of one or more cipher strings separated by ':'. Default is !aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES. --thread-pool-size | -t Number of threads in the sfcb thread pool. Default is 5. --thread-stack-size | -T Minimum stack size allocated to sfcb threads. Default is 1048576. --ws-man | -W Enable or disable the WS-Management service (openwsmand). Enabled by default. Changes take effect when --enable is specified. --help Show the help message.
system wbem provider list	Display WBEM provider configuration.	--help Show the help message.
system wbem provider set	This command is used to manage ESX CIMOM providers.	--enable | -e Enable or disable the provider immediately. Values: [yes|no, true|false, 0|1] --name | -n Specify provider identifier. (required) --help Show the help message.
system welcomemsg get	Get the Welcome Message for DCUI.	--help Show the help message.
system welcomemsg set	Set the Welcome Message for DCUI.	--message | -m Welcome Message String. (required) --help Show the help message.