Skip to content

Add vmware vCenter support bundle and ESXi plugins#1878

Open
Matthijsy wants to merge 4 commits into
fox-it:mainfrom
Matthijsy:feature/vmware-vcenter
Open

Add vmware vCenter support bundle and ESXi plugins#1878
Matthijsy wants to merge 4 commits into
fox-it:mainfrom
Matthijsy:feature/vmware-vcenter

Conversation

@Matthijsy

@Matthijsy Matthijsy commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Resolves #1877

Add vmware vCenter support bundle

This PR adds a child plugin to identify vmware vCenter support bundles. These support bundles are zip files consisting of tgz files which are basically forensic collects of ESXi hypervisors.

Currently the name of the hypervisor is not extracted in the child plugin, as that would requiring opening all the tgz files, which is not nice from performance perspective.

Furthermore this PR also fixes the authentication log plugin to support the ESXi path and format. Lastly it introduces a new plugin to process the history file of an ESXi host. If we want these last two things in a seperate PR please let me know.

Checklist

  • PR Title is descriptive of the changes
  • The description is descriptive of the changes
  • Tests are included and pass
  • Closes related issue number

@Matthijsy Matthijsy changed the title Add vmware vCenter support bundle Add vmware vCenter support bundle and ESXi plugins Jul 7, 2026
@william-billaud

Copy link
Copy Markdown
Contributor

Fyi there is two PR related to ESXi

#1509 Improve ESXiPlugin support for recent version -> TLDR try to properly mount log folder for different loader (vmsupport/raw disk)
#1385 (Add support for ESXI auth, hostd and shell logs)

There is some overlap regarding auth.log, I think that the main difference is that in 1385 there is a common record for different ESXi log, in this PR this is a common record for auth format. IMO both are fine and it was more to highlight the point (E.g for IIS webserver logs there is two different record type for the same data).

@Matthijsy

Copy link
Copy Markdown
Contributor Author

Thank you for pointing it out! I did a check if there was a PR for the vCenter part, but forgot to do so for the ESXi plugins. I am more than happy to remove that part again if any of the other PRs are preferred.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add support for vmware vCenter support packages

2 participants