Create vCenter service accounts

Configure users and roles for vCenter

To create service accounts for the Splunk for VMware solution, you first need to create vCenter users, create roles, and then assign the users to the roles. This topic shows you how you can do this for vCenter.

Create users

A user is required for authentication and is assigned a role in later steps for authorization. The following steps show how to create local users. If you are using ActiveDirectory for authentication on your Windows OS (vCenter) machines and / or your ESX/i hosts, please skip to the "Make users in ActiveDirectory" section below.

Make local users on your Windows OS (vCenter) machines

Perform these steps to create a local user on each of your vCenter machines.

1. Log into the Windows OS with an administrator account.
2. Open the WindowsStart menu, then click Control Panel.
3. In the User Accounts screen, click Add or remove user accounts.
4. In the Manage Accounts window, click Create a new account.
5. Enter a name for the account (e.g. splunksvc) and select Standard user. Note if you add the new user as Administrator the user will automatically have an Administrator role in vSphere and a lesser role assigned to it will have no effect.
6. Click Create Account.
7. In the Manage Accounts screen now click on your new user.
8. In the Change an Account screen, click Create a password and assign the user a password.
9. The new user account is displayed as a Standard user and the account shows that it is Password protected.
10. You now have a local Windows user compatible with the vSphere permissions system.

See Microsoft Windows documentation for further information.

Create roles

You need to create roles on each vCenter machine.

To create a role on vCenter:

1. Open up the vSphere client and connect to the vCenter. Log in with administrative privileges.
2. Click Home in the path bar.
3. Under Administration click Roles.
4. Click the Add Role button.
5. In the Add new Role dialog, enter a name for the role (e.g. splunkreader).
6. Select the appropriate permissions for the role (see Required permissions in vSphere below).

Required permissions in vSphere

The following table lists the permissions for the role you create in vCenter for all of the VMware versions we support (4.1, 5.x). This is required so that the Forwarder Appliance can collect data from the VC.

Permission
Global.Diagnostics
Global.Licenses
Global.Settings
Host.Configuration.Change SNMP settings
Host.Configuration.Hyperthreading
Host.Configuration.Memory configuration
Host.Configuration.Network configuration
Host.Configuration.Power
Host.Configuration.Security profile and firewall
Host.Configuration.Storage partition configuration
Sessions.View and stop sessions
System.Anonymous*
System.Read*
System.View*

Click OK and you should see your role in the list of roles. If so, then you're done!

Note: For user-defined roles, the system-defined privileges "System.Anonymous", "System.Read", and "System.View" are always present.

Assign users to roles

1. In the vSphere client connect to the vCenter or ESX/i host that contains the user and role you created and now want to link together.
2. On the vCenter navigation bar, click Home.
3. In the Inventory view, click Hosts and Clusters.
4. Right-click on the root object in the tree and click "Add Permission" in the context menu.
5. On the Assign Permissions window, under Users and Groups click Add... .
6. Select the user you want to assign a role to (e.g. splunksvc) from the list, then click Add. Click OK.
7. In theAssign Permissions window, under Assigned Role, use the menu to select the role (e.g. splunkreader) to assign to the user.
8. Click the Propagate to Child Objects check box so that the user gets all the necessary permissions, then click OK.
9. Click the Permissions tab and verify the user exists with the assigned role.

Verifying log in credentials

Now that you have have service accounts set up on each VC and ESX/i host in your environment, you can verify that you set up your user credentials correctly for each one. To test that your credentials work correctly on a target machine, you can point the vSphere client at the machine or you can use a web browser to access its Managed Object Browser (MOB).

To validate credentials for a target machine using the MOB, provide the initial URL of that machine (hostname) with /mob appended to the end:

       https://<IP or DNS hostname of vCenter server or ESX/i host>/mob

You will be presented with a login dialog box, similar to the one shown here:

In some cases you may need to "add a security exception" in the browser to display the login dialog box. For the specific VC or ESX/i host that you are verifying, enter the corresponding username / password combination for that VC or ESX/i host.

Important: Do this validation step for each VC or ESX/i host that you created a service account for in the steps above. Creating a service account for a VC and validating that it works on the VC does not mean that it will also work on the ESX/i hosts in your environment. VC and ESX/i hosts have completely independent security subsystems. You must do the creation / mapping steps, as shown in this topic, for each VC and ESX/i host independently, and validate each one independently.

The service account credentials (username / password) you use to access the MOB are the same credentials used by the FA to get VMware data. You will use these credentials in your engine.conf and / or credentials.conf file(s) in a later installation step. If the credentials are not properly verified, the solution will not work properly. Although login problems are placed into the solution logs, they are nonetheless a pain to diagnose after the fact. It is much easier to make sure the service account credentials work properly beforehand.

If your login is not successful, then it will simply display the login box again with no further indication of failure. Try re-entering your username / password combination a few times to ensure that a typing error is not preventing you from accessing the MOB. If your login remains unsuccessful, retrace the steps you followed to create the service accounts. Multiple failures usually indicates that there was a problem setting up the credentials when you created the user account, role, or mapping the permissions. Re-trace your creation steps (above) for this particular machine to fix the issue.

If you are successful logging into the MOB, then a Web page similar to the following is displayed for each VC or ESX/i host:

Congratulations! Your service account is set up correctly! Now just remember to do this for each VC and ESX/i host that you will add to the Splunk for VMware Solution and you will be all set.

Note: You can also test that you created valid user credentials by logging into the VC machine or ESX/i host using the vSphere Client. If you can point the vSphere Client at each machine and log in successfully using the corresponding credentials, then you have correctly set up the service account. If is effectively the same as logging into the target machine's MOB.