Dell VxRail Operate cheat sheet

VxRail is a hyperconverged system from Dell that runs VMware vSphere and vSAN on a single integrated appliance stack; Dell provides the hardware, the VxRail Manager software layer, and lifecycle tooling on top of VMware software.

Node families: V (general-purpose hybrid), P (performance, NVMe), S (storage-dense), E (edge/rugged, short depth), D (dense compute), G (GPU/VDI), plus satellite and stretched-cluster node types.

A VxRail cluster needs a minimum of 3 nodes for standard vSAN configurations; a 2-node cluster requires a direct-connect witness appliance for quorum.

VxRail Manager is a virtual appliance (VXM) running on the cluster; it exposes the VxRail API, plugin for vCenter, and drives lifecycle operations.

The VxRail plugin for vCenter integrates VxRail Manager into the vSphere Client; the VxRail API is REST-based and authenticated via token.

Bootstrap/deployment is initiated from VxRail Manager's deployment wizard or the VxRail Configuration Portal (VxRail deploy service), which discovers nodes via their iDRAC/service tag and configures vSphere, vSAN, and networking.

VxRail supports both customer-supplied and Dell-supplied ToR switches; the network plan must define management, vMotion, vSAN, and VM traffic VLANs before deployment.

System software versions are paired: VxRail software bundle, vSphere/vSAN version, and firmware baseline are validated together in the VxRail compatibility matrix.

Before deployment: assign iDRAC IPs, set DNS/NTP, define VLANs, provide vCenter details (new or existing), and confirm the VxRail deployment worksheet values.

VxRail Manager initial setup requires a DNS-resolvable FQDN, a management IP, and matching forward/reverse DNS records; NTP must be reachable to avoid certificate and vSAN issues.

vCenter deployment options: deploy a new vCenter appliance managed by VxRail, or join an existing vCenter; VxRail Manager credentials must have appropriate permissions in that vCenter.

Cluster creation sets vSAN datastore policy defaults; after deployment, verify vSAN health, cluster HA/DRS settings, and that all hosts are in a connected state.

Initial configuration includes setting the vSAN datastore name, enabling vSphere HA/DRS, configuring the vMotion network, and validating the VM network port groups.

The VxRail Configuration Portal uses the VxRail deploy service and a JSON/answer-file style input; it is used for factory-to-site deployment automation.

Post-deployment, register the VxRail plugin and confirm VxRail Manager shows cluster health as 'Healthy' before adding workloads.

Changing cluster-level settings (e.g., vSAN stretched cluster, witness) after deployment requires specific VxRail procedures and should be validated against the compatibility matrix.

VxRail Manager provides cluster health, alerts, and lifecycle status; vCenter provides VM/host performance and alarms; vSAN Health Service provides vSAN-specific checks.

VxRail API endpoints include /rest/vxm/v1/ for cluster, hosts, system, and lifecycle operations; authentication uses POST /rest/vxm/v1/session with basic auth returning a token.

Key monitoring targets: vSAN health checks (physical disk, network, cluster), host hardware via iDRAC/OMSA, and VxRail Manager service status.

VxRail events and alarms can be forwarded to syslog and SNMP; configure these in VxRail Manager and vCenter alarm actions.

vRealize Operations / Dell CloudIQ integration provides capacity and performance analytics for VxRail; CloudIQ requires registration and connectivity.

Use 'vxrail-manager' CLI commands and the VxRail API for scripted health checks; avoid direct edits to VxRail Manager database or config files.

VxRail Manager logs are in /var/log/vxrail/ and /var/log/vmware/; support bundles can be generated via the UI or CLI for Dell support.

Cluster capacity monitoring: vSAN datastore free space, rebuild/resync status, and slack space should be reviewed; vSAN requires reserved slack space for rebuilds.

VxRail uses a vDS (vSphere Distributed Switch) by default; VxRail Manager creates port groups for management, vMotion, vSAN, and VM traffic.

vSAN network must be a dedicated VLAN with MTU consistent across all hosts; jumbo frames (MTU 9000) require end-to-end support including physical switches.

vSAN traffic types: vSAN, vMotion, management, and VM; each should be on separate VLANs; vSAN uses unicast and requires all hosts reachable on the vSAN network.

For 2-node clusters, the witness appliance sits on a separate network and requires connectivity to both nodes; direct-connect witness uses dedicated ports.

vSAN stretched clusters require a witness host at a third site; the witness must be on a network reachable from both data sites and have consistent MTU.

Adding a host to a VxRail cluster: validate the host is on the same VxRail version, network config matches, and vSAN can absorb the host; use the VxRail 'Add Host' workflow.

Removing a host: put host in maintenance mode with 'Ensure Accessibility' or 'Full Data Migration' as appropriate; vSAN rebuilds data before host removal.

vSAN disk groups: each disk group has one cache tier (SSD/NVMe) and capacity tier; cache device failure can affect the entire disk group.

VxRail lifecycle management (VxRail Manager + VxRail API) performs coordinated upgrades of VxRail software, vSphere/vSAN, and firmware via the VxRail bundle.

Upgrade prerequisites: verify the target version in the VxRail compatibility matrix, ensure cluster health is green, NTP/DNS are correct, and sufficient free space exists.

VxRail uses the 'VxRail Upgrade' workflow; it can upgrade vCenter, ESXi hosts, VxRail Manager, and firmware in a defined sequence with pre-checks.

The VxRail upgrade bundle includes the vSphere/vSAN version and firmware; bundles are cumulative and must be applied in supported paths (no skipping unsupported versions).

vCenter upgrade in VxRail: VxRail Manager orchestrates the vCenter upgrade; for external vCenter, the customer is responsible for vCenter upgrades unless using VxRail-managed vCenter.

Host upgrades use vSphere Update Manager (VUM) or vSphere Lifecycle Manager (vLCM) depending on version; VxRail Manager coordinates with these.

Pre-upgrade checks include vSAN health, disk space, snapshot cleanup, and confirming no active alarms; failed pre-checks block the upgrade.

Post-upgrade: verify VxRail Manager version, vCenter version, host versions, and vSAN health; re-register plugins if needed.

VxRail Manager service failures: check /var/log/vxrail/, restart services via 'systemctl restart vxrail-*' or use the VxRail Manager CLI; collect support bundle for Dell.

vSAN health failures: run vSAN Health Service checks; common causes include network MTU mismatch, disk failures, and certificate expiration.

Certificate expiration: vCenter and VxRail Manager certificates must be valid; expired certs cause plugin and API failures; renew via VxRail Manager or vCenter Certificate Manager.

Host not in cluster / disconnected: check iDRAC, network connectivity, and ESXi host state; re-add host via VxRail workflow after resolving.

vSAN data recovery: if a host fails, vSAN rebuilds from replicas; if multiple failures exceed policy, data may be unavailable; restore from backup.

VxRail Manager database corruption: restore from backup or redeploy VxRail Manager; the VxRail API and CLI provide backup/restore options.

Support bundle collection: use VxRail Manager UI or 'vxrail-manager' CLI to generate logs for Dell support; include vCenter and ESXi logs.

Recovery of vCenter: if vCenter is unavailable, VxRail Manager operations may be limited; restore vCenter from backup or use VxRail Manager's vCenter recovery procedures.

VxRail Manager uses role-based access: admin, operator, and viewer roles; integrate with vCenter SSO and Active Directory for authentication.

vCenter SSO is the identity source; VxRail Manager users are managed via vCenter permissions; use least-privilege roles for API and UI access.

VxRail API authentication: obtain a token via POST /rest/vxm/v1/session; tokens expire and must be refreshed; use HTTPS only.

Certificates: VxRail Manager and vCenter use VMCA-signed certificates by default; replace with enterprise CA certificates for compliance; renew before expiration.

Network security: isolate management, vSAN, vMotion, and VM traffic on separate VLANs; restrict iDRAC and VxRail Manager access to management networks.

Audit logging: forward VxRail Manager and vCenter logs to syslog/SIEM; enable vCenter audit and event logging for compliance.

Hardening: disable unused services, enforce strong passwords, enable account lockout, and apply firmware/software updates per the VxRail security advisories.

Compliance: VxRail supports FIPS 140-2 validated cryptography in supported versions; confirm the specific version in the VxRail security documentation.