Censusby Steward IT

Documentation › Using Steward IT Census

Hypervisors and cloud (VMware, Hyper-V, Proxmox, XCP-ng, AWS)

Steward IT Census inventories your hypervisors and every virtual machine on them, including VMs that are switched off, have no agent, or run an operating system nothing else can scan.

Azure virtual machines are read through the Entra ID sync instead: see Active Directory and Entra ID. The same page (Scanning › Hypervisors, cloud & MDM) also connects Microsoft Configuration Manager, Google Workspace, Workspace ONE, UniFi and Cisco Meraki: see Configuration Manager, Google Workspace, Workspace ONE, UniFi and Meraki.

VMware vCenter / ESXi Hyper-V Proxmox VE XCP-ng / XenServer
Setup Add the vCenter Server (or each standalone ESXi host) under Scanning › Hypervisors, cloud & MDM None: a Hyper-V host inventoried by the Census agent or a WinRM scan reports its VMs Add one node per cluster (port 8006) with an API token Add the pool master
Hosts Each ESXi host becomes a Hypervisor asset: vendor, model, serial, CPU, memory, ESXi version and build, cluster The host is its normal Windows Server asset Each node: CPU, memory, Proxmox VE version, kernel, cluster Each host: vendor, model, serial (BIOS), CPU, memory, version, pool
VMs Name, power state, vCPUs, memory, disk size, guest OS, host name and IP addresses (VMware Tools), MAC addresses, cluster, notes Name, state, vCPUs, memory, disk size, MAC and IP addresses, guest host name and OS (Hyper-V data exchange integration service) QEMU VMs and LXC containers: name, state, vCPUs, memory, disk, MAC addresses, OS type, notes; host name, OS and IPs from the QEMU guest agent / the container Name, state, vCPUs, memory, disk, MAC addresses; OS and IPs from the guest tools

AWS EC2 instances are read per AWS account (see AWS EC2).

VMware setup#

  1. Create an account in vCenter (or on the ESXi host) with the built-in Read-only role, given at the top of the inventory so it sees every host and VM.
  2. Add it as a credential: Scanning › Credentials, type VMware vCenter / ESXi.
  3. Scanning › Hypervisors, cloud & MDM (VMware tab): enter the vCenter or ESXi address (e.g. vcenter.corp.local), pick the credential and how often to sync (default every 4 hours). Saving syncs right away.

vCenter and ESXi normally use self-signed certificates. The certificate is trusted on the first sync and checked on every sync after that, like SSH host keys; if it changes the sync stops with the server's certificate changed. If you replaced or renewed the certificate, click Trust new certificate.

Add the vCenter Server once rather than each host it manages. Standalone ESXi hosts (not in a vCenter) are added one by one.

Proxmox VE setup#

  1. In Proxmox: Datacenter › Permissions › Users › Add a user such as census@pve, then API Tokens › Add a token for it (e.g. inventory). Untick Privilege Separation (or give the token the role below too). Copy the token secret.
  2. Permissions › Add › User Permission: path /, the user, role PVEAuditor (read-only).
  3. Scanning › Credentials, type Proxmox VE (API token): token ID census@pve!inventory, secret = the token secret.
  4. Scanning › Hypervisors, cloud & MDM › Proxmox VE: one node's address (e.g. pve1.corp.local; port 8006 is added), the credential, how often to sync. One node is enough for a whole cluster.

The node's certificate is trusted on the first sync, like VMware's. Guest host names, operating systems and IP addresses of QEMU VMs need the QEMU guest agent inside the VM (and QEMU Guest Agent enabled in the VM's options); containers report their addresses without it. Templates are left out.

XCP-ng / XenServer setup#

  1. Use the pool's root account, or with Active Directory integration an account with the read-only role.
  2. Scanning › Credentials, type XCP-ng / XenServer.
  3. Scanning › Hypervisors, cloud & MDM › XCP-ng / XenServer: the pool master's address (a pool member answers with the master's address, which Census then names). The certificate is trusted on the first sync.

VMs that are switched off appear under the host they're pinned to (affinity), else under the pool master. Guest OS and IP addresses need the XCP-ng / XenServer guest tools in the VM.

AWS EC2#

  1. In AWS IAM, create a user (or role for an access key) with the managed policy AmazonEC2ReadOnlyAccess, or just ec2:DescribeInstances, ec2:DescribeRegions and ec2:DescribeInstanceTypes. Create an access key for it.
  2. Scanning › Credentials, type AWS (access key): access key ID and secret access key.
  3. Scanning › Hypervisors, cloud & MDM › AWS EC2: leave Regions empty for every region enabled in the account, or list some (us-east-1, eu-west-1). One connection per AWS account.

Each instance becomes an asset (terminated ones are left out) with its account, availability zone, VPC, instance type (vCPUs, memory), power state, AMI, private and public IP addresses and MAC addresses. Its Summary shows Runs on AWS. An instance that also runs the Census agent, or is scanned over WinRM/SSH, merges with that inventory by MAC address or name, which stays the main source. Report: AWS EC2 instances. Census calls the AWS API over the internet (ec2.<region>.amazonaws.com).

Hyper-V#

When the Census agent (or a WinRM scan) inventories a Windows computer with the Hyper-V role, it also runs Get-VM and reports the VMs. VMs whose integration services are running also report their own host name and operating system, which helps match them to their assets. Hyper-V clusters and System Center VMM aren't queried separately: each host reports the VMs running on it.

On the asset pages#

  • A host (ESXi Hypervisor, or a Hyper-V Windows Server) has a Virtual machines tab listing its VMs with power state, guest OS, IP, CPUs, memory, disk and cluster.
  • A VM's Summary shows Runs on with its host, platform, cluster and power state. A VM that moves to another host (vMotion, live migration) follows it at the next sync.

How VMs and their own inventory merge#

A VM is one asset, whether it was found by the hypervisor, the Census agent inside it or a network scan:

  • VMware: the VM's BIOS serial number (VMware-42 1a 2b …, from its UUID) is the same one the agent or a WinRM/SSH scan reads inside the guest.
  • Hyper-V, Proxmox, XCP-ng, AWS: by MAC address, then by name.

The agent's or scan's inventory is richer and always wins; the hypervisor fills in what's missing and keeps powered-off VMs on the list. VMs count as assets for licensing like any other asset.

Reports#

Virtual machines by host, Powered-off virtual machines (clean-up candidates), Hypervisor hosts (with a chart of VMs per host), Azure virtual machines and AWS EC2 instances, under Reports › Virtualization; the report builder covers VMs through the asset fields.