// Guide · Day 2 operations
ESX CLI Quick Reference
A searchable, task-organized reference for ESX command-line tools — esxcli, vim-cmd, esxcfg, dcli, and nsxcli. Browse by workflow (patch an ESX host, reset root password, troubleshoot host disconnect, collect support bundle, verify NSX transport health, add storage), filter by risk, copy-paste ready. Covers ESX 8.x and VCF 9.
Quick start
- Browse by workflow — pick a task (Patch an ESX Host, Reset Root Password, Troubleshoot Host Disconnect, etc.) and step through ordered commands.
- Or search — type keywords to filter commands by name, description, or tool.
- Switch view mode — Cards (visual, grouped) or Table (scannable list).
- Check risk and location badges — each command shows whether it's safe/risky and where to run it (host shell, vCenter, NSX Manager).
- Copy commands — click the Copy button to grab a single command, or Copy all commands for the entire workflow.
On this page
When to use this tool
Use this reference when you need to:
- Execute a Day 2 task quickly without grepping through VMware docs for the right syntax.
- Train a junior engineer on ESX CLI — they can browse workflows end-to-end.
- Refresh your memory on a rare operation (patch via CLI, reset lost root password, collect support bundle).
- Compare tools — same operation may be doable via esxcli, vim-cmd, or dcli; the reference shows all variants.
- Check if a command is safe before running in production — the risk indicators surface disruptive operations.
Always verify in a lab first
Even "safe" commands can behave unexpectedly on your specific environment. Test in a non-prod lab before running in production, especially anything that modifies state.
How it works
ESX has five primary CLI tools, each with different scope and use:
- esxcli — modern, structured command namespace. Most operations are here. Use first.
- vim-cmd — lower-level vSphere API shell. Used when esxcli doesn't expose the operation.
- esxcfg-* — legacy commands (esxcfg-vmknic, esxcfg-vswitch…). Still useful for specific network tasks.
- dcli — Datacenter CLI — runs vCenter API commands from anywhere (no SSH to host needed).
- nsxcli — NSX-specific CLI on NSX Manager and transport nodes.
The reference organizes commands by task (what you're trying to accomplish) rather than by tool, so you can find the right command without knowing which CLI ships it.
Each command entry shows: syntax, description, tool it belongs to, risk level, where to run it, and typical output.
Step-by-step walkthrough
1. Find commands by workflow
The top of the reference lists common Day 2 workflows:
- Patch an ESX Host — put in maintenance, apply patch, reboot, exit maintenance
- Reset ESX Root Password — single-user-mode recovery
- Troubleshoot Host Disconnect — investigate why vCenter lost connection
- Collect Support Bundle — generate vm-support bundle for VMware support
- Verify NSX Transport Node Health — check NSX tunnel/BFD state on a host
- Add New Storage / LUN — present a new LUN and create a datastore
Click a workflow to see the ordered command sequence with context.
2. Search for specific commands
The search box filters commands as you type. Works across command name, description, and tool. Example searches:
vmkfstools— all storage operationstcpdump— packet capture commandsvmkping— connectivity testingmaintenance— enter/exit maintenance mode commands
3. Switch between Cards and Table view
Two view modes:
- Cards (default) — each command as a card with description and copy button. Best for browsing.
- Table — dense list with name, tool, risk, description columns. Best for scanning many commands quickly.
4. Read the badges
Every command has badges:
- Tool badge — esxcli, vim-cmd, esxcfg, dcli, or nsxcli
- Risk badge — safe (read-only), caution (modifies state), danger (disruptive/data loss possible)
- Where to run — ESX shell, vCenter, NSX Manager, workstation (for dcli)
Check badges before running anything in production. "Danger" badges mean: maintenance window, backup, understand the blast radius.
5. Copy and run
Click Copy on any single command to grab just that line. Click Copy all commands at the top of a workflow to grab the whole sequence (useful for runbook creation).
Examples
Workflow example · Patch an ESX Host
The reference walks through:
# 1. Migrate VMs off or let DRS handle esxcli system maintenanceMode set --enable true # 2. Apply the patch (image profile update) esxcli software profile update --depot /vmfs/volumes/<ds>/esxi-patch.zip \ --profile ESXi-8.0U2-build # 3. Reboot reboot # 4. After reboot, exit maintenance esxcli system maintenanceMode set --enable false
Each step links to the full command reference entry with options and gotchas.
Search example · "datastore"
Typing datastore in search surfaces:
esxcli storage vmfs extent list— show datastore extentsesxcli storage filesystem list— all mounted filesystemsvmkfstools -P <path>— inspect VMFS filesystemesxcli storage core device list— all storage devices
All shown with their tool, risk level, and example outputs.
Common mistakes
Running commands on the wrong host
Many commands affect only the local host they run on. Running "put in maintenance" on a host via SSH means you put THAT host in maintenance — not the one you meant. Verify hostname with
hostname before anything destructive.
Using esxcfg-* instead of esxcli
Legacy esxcfg-* commands still work but the modern equivalents via esxcli are preferred. Some esxcfg commands are being deprecated — use esxcli where both exist.
Skipping maintenance mode for patches
Never patch a host with running VMs. Always enter maintenance mode first; VMs either migrate via DRS or need manual migration.
Running vm-support on small datastores
Support bundles can be 5-50GB. Default output is
/var/tmp/ on ESX (RAM disk, limited space). Use -d <datastore_path> to write to a VMFS datastore with space.
dcli authentication surprises
dcli uses a credential store by default, but if no cached credentials, it prompts interactively. In scripts, use
+username and +password or the credential file — otherwise dcli waits on stdin.
nsxcli on the wrong NSX component
nsxcli runs on NSX Manager, Edge, and transport nodes — same tool, different subsets of commands available. "get logical-router" works on Edge; "get transport-nodes" works on Manager. Use the right node.
Related tools
Tools that pair well with ESX CLI Quick Reference:
FAQ
What's the difference between esxcli and vim-cmd?
esxcli is the modern, structured namespace — most operations belong here. vim-cmd is lower-level (vSphere API shell) and exposes things esxcli doesn't, like per-VM ops and some legacy functions. Use esxcli first; fall back to vim-cmd when you need what esxcli doesn't have.
Can I run esxcli from outside the host?
Yes —
esxcli --server <vcenter> --username [email protected] runs commands remotely via the vSphere API. Behavior is usually identical to running on the host directly.How do I find which esxcli namespace a command lives in?
Run
esxcli help at each level to explore. Or use this reference's search — typing vmknic surfaces esxcli network ip interface commands.Does the reference cover PowerCLI?
Not currently — scope is on-host CLI tools (esxcli, vim-cmd, esxcfg, dcli, nsxcli). PowerCLI is a PowerShell module with different idioms; a PowerCLI reference is on the roadmap.
How do I collect a support bundle for VMware GS?
The "Collect Support Bundle" workflow covers this. TL;DR:
vm-support -a -d /vmfs/volumes/<ds>/supportbundles/ on the host, or from vCenter for multi-host bundles.Are all commands safe to run without a maintenance window?
No — that's why risk badges exist. Read-only list/show commands are safe. Anything modifying storage, network, or host state needs a maintenance window and proper change control.