The call is usually the same. A VCF on VxRail estate has been unattended longer than anyone planned, something is degraded, and the first instinct is to start changing credentials and certificates because those are the things that expire. That instinct wastes the first day. The first day is an assessment, in a fixed order, with a written boundary around what not to touch.
The Order
The assessment we use on VCF 5.2.x on VxRail, aimed at 5.2.1, walks the management plane before it walks the hosts:
- Intake. What the site thinks is broken, and which cluster is actually in scope.
- SDDC Manager health.
- vCenter and vSphere health.
- vSAN Skyline health.
- NSX Manager and edge health.
- VxRail Manager health.
- ESXi host health.
- The diagnostic bundles: VDT, VCFV, and VxV.
- A per-cluster inventory capture, so the next person is not reconstructing the estate from memory.
The order is the point. VxRail Manager symptoms are often downstream of SDDC Manager or vCenter. Starting at the host because that is where the alarm is firing produces a reboot plan for a certificate problem two layers up.
The Check People Skip on Online Clusters
Depot and bundle recovery is no longer an air-gap-only document. Dell’s NGSSO decommission changed how VxRail fetches bundles, and the change hit online environments as well. A cluster that can route to the internet can still be unable to download the bundle the upgrade UI is offering. If that check is not in the first pass, the upgrade plan you write on day two is fiction.
Certificate rotation is the other companion, and it comes after you know which certificates are expired, not before. Rotating the management-plane certificates on a hunch, before SDDC Manager and vCenter have been read, is how an assessment becomes an outage. The rotation guide is a follow-on. It is not step one.
The Boundary
The assessment has an explicit list of operations it will not perform in the first pass. That list exists because a quiet estate attracts drive-by fixes: a host reboot, a manager restart, a credential change “while we are here.” None of those belong in the health capture. Capture first. Remediate from the companion document that matches the failed phase. If the failed phase is the depot, the depot guide is the next document. If it is certificates, the certificate guide is. The triage document does not try to be all five.
That split is what makes the library reusable on the next estate. A single runbook that mixes assessment and remediation gets edited in the field until it no longer matches either job.
The Results
The first day produces a written health capture and a named next document, not a reboot plan. SDDC Manager, vCenter, vSAN, NSX, VxRail Manager, and the hosts are read in that order. The depot check is in the first pass even when the cluster can route to the internet. Certificate rotation waits until the assessment says which certificates are actually expired.
Lessons Learned
VxRail Manager symptoms are often downstream of SDDC Manager or vCenter. Starting at the host because that is where the alarm is firing produces a reboot plan for a problem two layers up. A single runbook that mixes assessment and remediation gets edited in the field until it no longer matches either job.
Getting Started
Write the scope on the first page: which cluster, and what the site thinks is broken. Walk the management plane before the hosts. Capture the diagnostic bundles and a per-cluster inventory before anyone changes a credential. If the failed phase is the depot, the next document is the depot guide. If it is certificates, the certificate guide. This note does not try to be both.
Conclusion
An estate that has been left alone does not need a hero on day one. It needs an order, a depot check even when the cluster is online, and a boundary around what the assessment will not touch.
There is no repository for this one. The deliverable is the order. Certificate replacement is a different job, and it is not this assessment.
Related Stories:
- The VCF Workload Domain That Said It Was Already Upgraded — another screen that summarized a record it did not match
- Getting a Standalone ESXi Host Ready for VCF Commissioning — a host that is not in the estate yet