VCP-VVF Admin (2V0-16.25) cheat sheet

ESXi 7.0 and later require a boot device of at least 32 GB; 128 GB or larger is recommended for production hosts.

The scratch partition is created on the boot device; when the device is small or is USB/SD, scratch is placed in RAM and its contents are lost on reboot.

Maintenance mode evacuates powered-on VMs from a host; the 'Ensure accessibility' option keeps vSAN data reachable while the host is in maintenance mode.

Lockdown mode Normal allows DCUI and the vSphere API but blocks the ESXi Shell and SSH; Strict mode permits connections only from vCenter.

UserVars.ESXiShellTimeOut and UserVars.ESXiShellInteractiveTimeOut control automatic logout of the ESXi Shell and its idle sessions.

Host profile workflow: capture the profile from a reference host, attach it to hosts or a cluster, check compliance, then remediate.

esxcli software vib install/update -d applies individual VIBs, while esxcli software profile update applies a full image profile.

The DCUI (F2) can configure the management network, restart management agents, view logs, and reset the host configuration.

vCenter 7.x and 8.x are deployed only as the vCenter Server Appliance (VCSA); the Windows vCenter Server installation is no longer supported.

The default Single Sign-On domain is vsphere.local, and the embedded Platform Services Controller model is the only one available in vCenter 7 and later.

Identity sources include Active Directory (Integrated Windows Authentication), Active Directory over LDAP, generic LDAP, local OS users, and SAML/OIDC federated identity.

A vCenter 8.0 instance supports a maximum of 250 ESXi hosts and 10,000 powered-on virtual machines.

Enhanced Linked Mode requires all vCenters to join the same SSO domain; it presents one inventory and one login across the linked vCenters.

Native vCenter backup is configured in VAMI on port 5480 and can write to FTP, FTPS, HTTP, SMB, NFS, or SFTP locations.

vCenter High Availability uses active, passive, and witness nodes; the witness node is required for automatic failover.

vCenter upgrades use the Update Planner for interoperability checks and a reduced-downtime upgrade that deploys a new appliance and copies data.

Core VM files: .vmx (configuration), .vmdk plus -flat.vmdk (disk), .nvram (BIOS state), .vmsd/.vmsn (snapshot metadata/state), .vswp (swap), and .log.

A VM supports up to 32 snapshots in a chain; snapshots preserve state for rollback but are not backups and should be consolidated.

A full clone copies the entire virtual disk; a linked clone references a parent snapshot and stores only delta changes, so it depends on the parent.

Converting a VM to a template makes it read-only; new VMs are deployed from it with 'New VM from This Template'.

Guest OS customization uses Sysprep answer files for Windows and cloud-init or open-vm-tools scripts for Linux guests.

Thin disks allocate blocks on first write; lazy zeroed thick disks zero on first write; eager zeroed thick disks zero at creation and are required for Fault Tolerance.

Hot-add of CPU or memory requires guest OS support and the CPU/Memory Hot Plug settings enabled while the VM is powered off.

VM hardware version 20 corresponds to ESXi 8.0; a VM cannot use features from a hardware version higher than the host supports.

A standard vSwitch supports up to 4088 ports; each port group carries a single VLAN ID together with its own security, teaming, and shaping policies.

VLAN ID 0 means no tagging, IDs 1-4094 select an access VLAN, and ID 4095 marks the port group as a trunk (VGT) so the guest tags its own VLANs.

Teaming policies: route based on originating virtual port (default), IP hash (requires LACP/IEEE 802.3ad), source MAC hash, and explicit failover order.

Standard switch security defaults are Promiscuous = Reject, MAC Address Changes = Accept, Forged Transmits = Accept.

Jumbo frames require MTU 9000 configured end to end: vSwitch or distributed switch, VMkernel adapter, physical switch ports, and the guest NIC.

TCP/IP stacks are default, vMotion, provisioning, and iSCSI; each VMkernel adapter is bound to exactly one stack.

Network I/O Control on a distributed switch allocates bandwidth with shares, reservations, and limits per network resource pool.

LACP port channels and static port channels are configured on the uplink port group of a distributed switch, not on a standard switch.

VMFS6 uses a 1 MB file block, supports 512e drives, and allows a maximum virtual disk size of 62 TB on a 64 TB datastore.

NFS 4.1 adds Kerberos authentication, multipathing, and session trunking compared with NFS 3.

Software iSCSI multipathing requires VMkernel port binding so each adapter is associated with a specific vmhba.

Path Selection Policies are VMW_PSP_FIXED, VMW_PSP_RR, and VMW_PSP_MRU; SATPs claim devices based on vendor and model.

Round Robin is the default PSP for ALUA-compliant arrays; the IOPS-per-path setting controls how often the active path switches.

vSAN requires at least 3 hosts; FTT=1 with RAID-5 needs 4 hosts and FTT=2 with RAID-6 needs 6 hosts.

vSAN OSA (original storage architecture) uses cache and capacity tiers, whereas vSAN ESA in 8.0 uses a single-tier NVMe flash model.

VAAI primitives: ATS for locking, XCOPY for clone offload, WRITE_SAME for zeroing, and UNMAP for thin-space reclamation.

Storage I/O Control throttles datastore I/O with shares, limits, and reservations; Storage DRS balances datastores within a datastore cluster.

HA admission control policies are cluster resource percentage (default), slot policy, and dedicated failover hosts.

HA uses network heartbeats plus optional datastore heartbeats to distinguish an isolated host from a network partition.

DRS automation levels are manual, semi-automatic (initial placement only), and fully automated.

DRS rules include VM-VM affinity and anti-affinity, VM-Host affinity (required or preferential), and VM-VM should-run rules.

EVC masks CPU features to a common baseline so hosts of different CPU generations stay vMotion-compatible within a cluster.

Fault Tolerance supports up to 4 vCPUs per VM and requires a dedicated VMkernel network for FT logging traffic.

A vSphere cluster supports up to 96 ESXi hosts; resource pool shares are relative among siblings, reservations are absolute, and expandable reservations let a pool borrow from its parent.

Distributed Power Management powers off hosts during low demand and powers them back on when DRS needs additional capacity.

A permission is the pairing of a user or group with a role on an inventory object; permissions are inherited down the hierarchy unless a child object overrides them.

System roles are Read-Only, Administrator, and No Access; custom roles are created from selected privileges.

ESXi local accounts include root (full access), vpxuser (created by vCenter to manage the host), and dcui (DCUI access only).

Certificate types managed by vCenter are the VMCA root, machine SSL, solution user, and ESXi host certificates; VMCA can be subordinated to an enterprise CA.

Certificates are replaced from the vSphere Client Certificate Management workflow or with certool on the vCenter appliance.

vSAN encryption protects all data at rest on the vSAN datastore using an external KMS, independent of per-VM encryption.

VM encryption uses a key management server plus VMCA-issued certificates, and encrypted VMs require vMotion encryption support on the destination host.

SSO password complexity, lockout, and token lifetime policies are configured per SSO domain and apply to all identity sources.

esxtop counters to check first: %RDY (CPU ready), %CSTP (co-stop), %MLMTD (max limited), %SWPWT (swap wait), and DAVG/KAVG/GAVG latency.

Real-time performance charts sample every 20 seconds and are retained for 1 hour; 1-day statistics use 5-minute rollups.

Key ESXi logs are /var/log/vmkernel.log, /var/log/hostd.log, and /var/log/vpxa.log; the main vCenter log is /var/log/vmware/vpxd/vpxd.log.

vm-support generates a support bundle on ESXi, and vCenter support bundles are generated from the appliance management interface or the vSphere Client.

vLCM clusters use a desired-state image composed of a base image, add-ons, components, and firmware via a hardware support manager, then remediate hosts to match.

Baselines and images cannot be mixed on the same cluster; a cluster is managed either by baselines or by a single image.

Alarms consist of triggers (condition, state, or event) and actions such as email, SNMP trap, script, or alarm action.

Update Planner checks interoperability and available updates for vCenter and its connected ESXi hosts before an upgrade.